libva-v4l2-request-fourier: bump pin to c454618 (#15 transparent resize)

Bumps both Arch PKGBUILD and Debian build-deb.sh pins to PR #16 — codec_store_buffer + request_pool_resize transparent OUTPUT-pool grow on a mid-session resolution upshift overrun. Picks up the frame- survival path that supersedes #13's drop-and-recreate fallback. Dual-pin per feedback_marfrit_packages_dual_pin so both Arch and Debian repos see check-already-published.sh report a new version.
Merge pull request 'daedalus-v4l2{,-dkms}: f0d4186 -> 79256dc — H.264 B-frame reorder fix + menu ctrls' (#67 ) from claude-noether/marfrit-packages:noether/daedalus-bump-79256dc into main
2026-05-21 13:24:21 +02:00 · 2026-05-21 10:51:14 +00:00 · 2026-05-21 12:41:12 +02:00 · 2026-05-21 10:38:03 +00:00 · 2026-05-21 12:19:04 +02:00 · 2026-05-21 09:28:47 +00:00
35 changed files with 16157 additions and 120 deletions
@@ -0,0 +1,230 @@
+#!/bin/bash
+# check-already-published.sh <recipe-dir>
+#
+# Decide whether a given recipe (arch/<name> or debian/<name>) is already
+# present in https://packages.reauktion.de/.  Emits exactly one line to
+# stdout:
+#
+#   skip=1   — package with this version-pkgrel-arch tuple already lives in
+#              the pool; CI should short-circuit.
+#   skip=0   — file is missing or HEAD failed; CI should build + publish.
+#
+# Design notes:
+#   * For Arch recipes we source the PKGBUILD in a clean subshell so
+#     shell expansions (epoch=, ${_pkgver/-/}, pkgname=() arrays) resolve
+#     naturally.  Only the first element of pkgname[] is checked — split
+#     packages share one source tarball / one build, so any-one-missing
+#     forces the full rebuild anyway.
+#   * For Debian recipes we extract the bare top-level PKGVER= /
+#     PKGREL= assignments (plus any other top-level VAR=value lines they
+#     reference) via grep and re-evaluate them in an isolated subshell —
+#     sourcing the entire build-deb.sh would run curl/tar/dpkg-deb
+#     against a tempdir we don't want to materialise here.
+#   * Epoch handling differs by ecosystem: Arch keeps `<epoch>:` in the
+#     pool filename, Debian/reprepro strips it.
+#   * curl --head with -f maps non-2xx to non-zero exit, which is what we
+#     want — 404 means "build it".  -L follows mirrors.  --max-time caps
+#     the worst-case latency per HEAD.
+set -euo pipefail
+
+REPO_BASE="${REPO_BASE:-https://packages.reauktion.de}"
+HEAD_TIMEOUT="${HEAD_TIMEOUT:-15}"
+
+RECIPE_DIR="${1:?usage: $0 <recipe-dir>   (e.g. arch/distcc-avahi or debian/lmcp)}"
+
+# Resolve relative to repo root if a leading path is passed; allow
+# both `arch/foo` and absolute paths.
+if [ ! -d "$RECIPE_DIR" ]; then
+  echo "error: recipe dir not found: $RECIPE_DIR" >&2
+  exit 2
+fi
+
+ecosystem="${RECIPE_DIR%%/*}"
+
+http_head() {
+  local url="$1"
+  curl -sS -L --max-time "$HEAD_TIMEOUT" -o /dev/null \
+       -w '%{http_code}' --head "$url" || echo "000"
+}
+
+emit() {
+  # one-line GITHUB_OUTPUT-compatible kv
+  echo "skip=$1"
+  exit 0
+}
+
+case "$ecosystem" in
+arch)
+  pkgbuild="$RECIPE_DIR/PKGBUILD"
+  [ -f "$pkgbuild" ] || { echo "error: $pkgbuild missing" >&2; exit 2; }
+
+  # Source in a fresh bash to capture variables. Some PKGBUILDs run
+  # functions or call commands at top level — keep this fast by
+  # restricting PATH and trapping side effects.
+  eval "$(
+    bash --noprofile --norc -c "
+      set +e
+      # Stub out anything that might shell out; we only need variable
+      # assignments to land.
+      cd '$RECIPE_DIR'
+      source ./PKGBUILD >/dev/null 2>&1 || true
+      # pkgname may be array; print first element.
+      if declare -p pkgname 2>/dev/null | grep -q 'declare -a'; then
+        first_name=\"\${pkgname[0]}\"
+      else
+        first_name=\"\$pkgname\"
+      fi
+      if declare -p arch 2>/dev/null | grep -q 'declare -a'; then
+        first_arch=\"\${arch[0]}\"
+      else
+        first_arch=\"\$arch\"
+      fi
+      printf 'PB_NAME=%q\n'   \"\$first_name\"
+      printf 'PB_VER=%q\n'    \"\$pkgver\"
+      printf 'PB_REL=%q\n'    \"\$pkgrel\"
+      printf 'PB_EPOCH=%q\n'  \"\${epoch:-}\"
+      printf 'PB_ARCH=%q\n'   \"\$first_arch\"
+    "
+  )"
+
+  if [ -z "${PB_NAME:-}" ] || [ -z "${PB_VER:-}" ] || [ -z "${PB_REL:-}" ]; then
+    echo "error: failed to parse PKGBUILD ($RECIPE_DIR)" >&2
+    emit 0
+  fi
+
+  # Pool arch:
+  #   arch=('any')                → any
+  #   arch=('aarch64' 'x86_64')   → aarch64 (we publish for both, but the
+  #                                 aarch64 artifact is the canonical CI build)
+  #   arch=('aarch64')            → aarch64
+  case "$PB_ARCH" in
+    any) pool_arch=any ;;
+    *)   pool_arch=aarch64 ;;
+  esac
+
+  # Version string with optional epoch (epoch:pkgver-pkgrel).
+  if [ -n "${PB_EPOCH:-}" ]; then
+    ver_full="${PB_EPOCH}:${PB_VER}-${PB_REL}"
+  else
+    ver_full="${PB_VER}-${PB_REL}"
+  fi
+
+  # Pool URL path (arch keeps any/aarch64 split; 'any' lands in the
+  # aarch64 dir per current marfrit layout — both arches share the
+  # blob via the publish-to-both-arches step in build.yml).
+  pool_dir="arch/aarch64"
+
+  base_url="${REPO_BASE}/${pool_dir}/${PB_NAME}-${ver_full}-${pool_arch}.pkg.tar"
+  for ext in zst xz gz; do
+    code=$(http_head "${base_url}.${ext}")
+    if [ "$code" = "200" ]; then
+      emit 1
+    fi
+  done
+  emit 0
+  ;;
+
+debian)
+  bd="$RECIPE_DIR/build-deb.sh"
+  ctrl="$RECIPE_DIR/control"
+  [ -f "$bd" ] || { echo "error: $bd missing" >&2; exit 2; }
+
+  # Pull top-level `VAR=value` lines until we've passed PKGREL, and
+  # only those whose RHS is safe to re-evaluate (no command
+  # substitution `$(...)`, no escaped `\$`, no embedded commands like
+  # `DESTDIR=... meson ...`).  This deliberately undershoots: we just
+  # need PKGVER/PKGREL plus any version vars they reference. Anything
+  # else (HERE=$(readlink ...), KERNELVER=\$(uname -r) inside a
+  # HEREDOC, etc.) gets dropped.
+  assigns=$(awk '
+    /^[A-Z_][A-Z0-9_]*=/ {
+      # split into LHS and RHS
+      eq = index($0, "=")
+      lhs = substr($0, 1, eq - 1)
+      rhs = substr($0, eq + 1)
+      # strip inline `# comment`
+      hash = index(rhs, "#")
+      if (hash > 1 && substr(rhs, hash-1, 1) == " ") rhs = substr(rhs, 1, hash - 2)
+      # reject lines with command-subst or escaped-dollar or naked commands
+      if (rhs ~ /\$\(/)   next
+      if (rhs ~ /\\\$/)   next
+      if (rhs ~ / [a-z]/) next   # e.g. `DESTDIR="$ROOT" meson ...`
+      print lhs "=" rhs
+      if (lhs == "PKGREL") exit
+    }
+  ' "$bd")
+
+  eval "$(
+    bash --noprofile --norc -c "
+      set +e
+      $assigns
+      printf 'PKGVER=%q\n' \"\${PKGVER:-}\"
+      printf 'PKGREL=%q\n' \"\${PKGREL:-}\"
+    "
+  )"
+
+  if [ -z "${PKGVER:-}" ] || [ -z "${PKGREL:-}" ]; then
+    echo "error: failed to parse PKGVER/PKGREL from $bd" >&2
+    emit 0
+  fi
+
+  # Strip epoch (`N:` prefix) — debian pool filenames omit it.
+  ver_no_epoch="${PKGVER#*:}"
+  # If PKGVER had no colon, ${PKGVER#*:} returns PKGVER unchanged (bash quirk:
+  # the pattern must match for the prefix to be stripped). Guard explicitly.
+  case "$PKGVER" in
+    *:*) : ;;
+    *)   ver_no_epoch="$PKGVER" ;;
+  esac
+
+  ver_full="${ver_no_epoch}-${PKGREL}"
+
+  # Architecture: parse control's `Architecture:` field.
+  if [ ! -f "$ctrl" ]; then
+    # Some recipes ship debian/control instead of ./control
+    ctrl="$RECIPE_DIR/debian/control"
+  fi
+  ctrl_arch=$(grep -m1 '^Architecture:' "$ctrl" 2>/dev/null | awk '{print $2}')
+  case "$ctrl_arch" in
+    all)            file_arch=all ;;
+    arm64|any)      file_arch=arm64 ;;
+    amd64)          file_arch=amd64 ;;
+    *)              file_arch=arm64 ;;  # conservative default
+  esac
+
+  pkg_name=$(basename "$RECIPE_DIR")
+
+  # Compare against the canonical Packages index (what apt actually
+  # consults).  reprepro refuses lower-version uploads, so checking
+  # only an exact source-pkgrel URL produces an endless-rebuild trap
+  # whenever source PKGREL has rolled back below pool head.  We skip
+  # if pools published version >= source version-tuple.
+  source_full="${ver_full}"
+  if [ -n "${PKGVER#*:}" ] && [ "${PKGVER}" != "${PKGVER#*:}" ]; then
+    # PKGVER had an epoch — keep it for dpkg --compare-versions.
+    source_full="${PKGVER}-${PKGREL}"
+  fi
+
+  # Determine suite: most recipes publish to both bookworm and trixie;
+  # checking trixie is sufficient (changelogs share Distribution).
+  suite="trixie"
+  pkg_arch_label="$file_arch"
+  [ "$file_arch" = "all" ] && pkg_arch_label="all"
+  packages_url="${REPO_BASE}/debian/dists/${suite}/main/binary-arm64/Packages"
+  [ "$file_arch" = "amd64" ] && packages_url="${REPO_BASE}/debian/dists/${suite}/main/binary-amd64/Packages"
+
+  pool_ver=$(set +o pipefail; curl -sS --max-time "$HEAD_TIMEOUT" "$packages_url" 2>/dev/null     | awk -v p="$pkg_name" '$1=="Package:" && $2==p {found=1; next} found && $1=="Version:" {print $2; exit}')
+
+  if [ -n "$pool_ver" ] && command -v dpkg >/dev/null &&        dpkg --compare-versions "$pool_ver" ge "$source_full"; then
+    echo "pool has $pool_ver >= source $source_full" >&2
+    emit 1
+  fi
+  echo "pool has $pool_ver, source wants $source_full — build" >&2
+  emit 0
+  ;;
+
+*)
+  echo "error: unsupported ecosystem '$ecosystem' (recipe-dir=$RECIPE_DIR)" >&2
+  emit 0
+  ;;
+esac
@@ -16,13 +16,23 @@ jobs:
    steps:
      - uses: actions/checkout@v4

+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh arch/distcc-avahi)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
      - name: bootstrap runner (idempotent)
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo avahi popt python python-setuptools

      - name: import signing key
+        if: steps.skip-check.outputs.skip != '1'
        env:
          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
@@ -37,6 +47,7 @@ jobs:
          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust

      - name: install deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
        run: |
@@ -46,6 +57,7 @@ jobs:
          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null

      - name: makepkg distcc-avahi
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          rm -rf /tmp/build-distcc-avahi
@@ -56,6 +68,7 @@ jobs:
          ls -la *.pkg.tar.* | grep -v "\.sig$"

      - name: sign distcc-avahi
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd /tmp/build-distcc-avahi
@@ -66,6 +79,7 @@ jobs:
          done

      - name: update aarch64 repo db
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          mkdir -p /tmp/arch-stage
@@ -105,6 +119,7 @@ jobs:
          rm -f marfrit.files.sig

      - name: publish to aarch64
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -129,13 +144,23 @@ jobs:
    steps:
      - uses: actions/checkout@v4

+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh debian/lmcp)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
      - name: install dpkg
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl

      - name: install hertz deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
        run: |
@@ -145,6 +170,7 @@ jobs:
          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null

      - name: build lmcp .deb
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd debian/lmcp
@@ -152,6 +178,7 @@ jobs:
          ls -la *.deb

      - name: upload + publish to suites
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -182,13 +209,23 @@ jobs:
    steps:
      - uses: actions/checkout@v4

+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh arch/lmcp)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
      - name: bootstrap runner (idempotent)
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo lua lua-socket

      - name: import signing key
+        if: steps.skip-check.outputs.skip != '1'
        env:
          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
@@ -203,6 +240,7 @@ jobs:
          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust

      - name: install deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
        run: |
@@ -212,6 +250,7 @@ jobs:
          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null

      - name: makepkg lmcp
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          rm -rf /tmp/build-lmcp
@@ -222,6 +261,7 @@ jobs:
          ls -la *.pkg.tar.* | grep -v "\.sig$"

      - name: sign lmcp
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd /tmp/build-lmcp
@@ -232,6 +272,7 @@ jobs:
          done

      - name: publish lmcp to both arches
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -283,13 +324,23 @@ jobs:
    steps:
      - uses: actions/checkout@v4

+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh arch/claude-his-agent)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
      - name: bootstrap runner (idempotent)
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo

      - name: import signing key
+        if: steps.skip-check.outputs.skip != '1'
        env:
          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
@@ -304,6 +355,7 @@ jobs:
          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust

      - name: install deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
        run: |
@@ -313,6 +365,7 @@ jobs:
          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null

      - name: makepkg claude-his-agent
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          rm -rf /tmp/build-his
@@ -323,6 +376,7 @@ jobs:
          ls -la *.pkg.tar.* | grep -v "\.sig$"

      - name: sign claude-his-agent
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd /tmp/build-his
@@ -333,6 +387,7 @@ jobs:
          done

      - name: publish claude-his-agent to both arches
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -387,13 +442,23 @@ jobs:
    steps:
      - uses: actions/checkout@v4

+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh arch/ffmpeg-v4l2-request-fourier)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
      - name: bootstrap runner (idempotent)
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo nasm

      - name: import signing key
+        if: steps.skip-check.outputs.skip != '1'
        env:
          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
@@ -408,6 +473,7 @@ jobs:
          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust

      - name: install deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
        run: |
@@ -417,6 +483,7 @@ jobs:
          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null

      - name: makepkg ffmpeg-v4l2-request-fourier
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          rm -rf /tmp/build-ffmpeg-v4l2
@@ -430,6 +497,7 @@ jobs:
          ls -la *.pkg.tar.* | grep -v "\.sig$"

      - name: sign ffmpeg-v4l2-request-fourier
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd /tmp/build-ffmpeg-v4l2
@@ -440,6 +508,7 @@ jobs:
          done

      - name: update aarch64 repo db
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          mkdir -p /tmp/arch-stage-ffmpeg
@@ -475,6 +544,7 @@ jobs:
          rm -f marfrit.files.sig

      - name: publish to aarch64
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -500,13 +570,23 @@ jobs:
    steps:
      - uses: actions/checkout@v4

+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh arch/libva-v4l2-request-fourier)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
      - name: bootstrap runner (idempotent)
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo

      - name: import signing key
+        if: steps.skip-check.outputs.skip != '1'
        env:
          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
@@ -521,6 +601,7 @@ jobs:
          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust

      - name: install deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
        run: |
@@ -530,6 +611,7 @@ jobs:
          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null

      - name: makepkg libva-v4l2-request-fourier
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          rm -rf /tmp/build-libva-v4l2
@@ -541,6 +623,7 @@ jobs:
          ls -la *.pkg.tar.* | grep -v "\.sig$"

      - name: sign libva-v4l2-request-fourier
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd /tmp/build-libva-v4l2
@@ -551,6 +634,7 @@ jobs:
          done

      - name: update aarch64 repo db
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          mkdir -p /tmp/arch-stage-libva
@@ -586,6 +670,7 @@ jobs:
          rm -f marfrit.files.sig

      - name: publish to aarch64
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -611,13 +696,23 @@ jobs:
    steps:
      - uses: actions/checkout@v4

+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh arch/mpv-fourier)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
      - name: bootstrap runner (idempotent)
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo

      - name: import signing key
+        if: steps.skip-check.outputs.skip != '1'
        env:
          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
@@ -632,6 +727,7 @@ jobs:
          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust

      - name: install deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
        run: |
@@ -641,6 +737,7 @@ jobs:
          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null

      - name: configure [marfrit] repo + pre-install ffmpeg-v4l2-request-fourier
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          # mpv-fourier links libavcodec at build time. If the build host pulls
@@ -668,6 +765,7 @@ jobs:
          printf 'y\ny\ny\n' | pacman -S marfrit/ffmpeg-v4l2-request-fourier

      - name: makepkg mpv-fourier
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          rm -rf /tmp/build-mpv
@@ -679,6 +777,7 @@ jobs:
          ls -la *.pkg.tar.* | grep -v "\.sig$"

      - name: sign mpv-fourier
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd /tmp/build-mpv
@@ -689,6 +788,7 @@ jobs:
          done

      - name: update aarch64 repo db
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          mkdir -p /tmp/arch-stage-mpv
@@ -724,6 +824,7 @@ jobs:
          rm -f marfrit.files.sig

      - name: publish to aarch64
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -746,13 +847,23 @@ jobs:
    steps:
      - uses: actions/checkout@v4

+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh debian/claude-his-agent)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
      - name: install dpkg
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl

      - name: install hertz deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
        run: |
@@ -762,6 +873,7 @@ jobs:
          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null

      - name: build claude-his-agent .deb
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd debian/claude-his-agent
@@ -769,6 +881,7 @@ jobs:
          ls -la *.deb

      - name: upload + publish to suites
+        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -784,3 +897,511 @@ jobs:
      - name: wipe secrets
        if: always()
        run: rm -f /root/.ssh/id_ed25519_hertz
+
+  # -------------------------------------------------------------------------
+  # ffmpeg-v4l2-request-fourier Debian (aarch64) — debian/<pkg>/build-deb.sh
+  # builds the Kwiboo FFmpeg fork natively on the arch-aarch64 runner using
+  # the arch toolchain + system libs, then dpkg-deb's the result.  Resulting
+  # .deb is rsynced to hertz; reprepro publishes into bookworm + trixie.
+  # -------------------------------------------------------------------------
+  ffmpeg-v4l2-request-debian:
+    needs: ffmpeg-v4l2-request-aarch64
+    runs-on: debian-aarch64
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh debian/ffmpeg-v4l2-request-fourier)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
+      - name: install build-deps (Arch pkg names; build-deb.sh links natively)
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          export DEBIAN_FRONTEND=noninteractive
+          retry apt-get update -qq
+          # Debian build-deps for the FFmpeg fourier-fork build.  These
+          # map 1:1 to the previous Arch list; libav*-dev intentionally
+          # absent (we are FFmpeg itself, providing those libs).
+          retry apt-get install -y --no-install-recommends \
+              build-essential git pkg-config nasm yasm \
+              linux-libc-dev libgl1-mesa-dev libasound2-dev libbz2-dev \
+              libfontconfig-dev libfribidi-dev libgmp-dev libgnutls28-dev \
+              libmp3lame-dev libass-dev libdav1d-dev libdrm-dev \
+              libfreetype-dev libpulse-dev libva-dev libvorbis-dev libvpx-dev \
+              libwebp-dev libx264-dev libx265-dev libxml2-dev libopus-dev \
+              v4l-utils liblzma-dev zlib1g-dev \
+              curl ca-certificates openssh-client rsync dpkg-dev
+
+      - name: install hertz deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
+        env:
+          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
+        run: |
+          mkdir -m700 -p /root/.ssh
+          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
+          chmod 600 /root/.ssh/id_ed25519_hertz
+          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
+
+      - name: build ffmpeg-v4l2-request-fourier .deb
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          cd debian/ffmpeg-v4l2-request-fourier
+          ./build-deb.sh
+          ls -la *.deb
+
+      - name: upload + publish to suites
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          cd debian/ffmpeg-v4l2-request-fourier
+          DEB=$(ls ffmpeg-v4l2-request-fourier_*.deb | head -1)
+          retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
+              marfritrepo@hertz.fritz.box:
+          for suite in bookworm trixie; do
+              retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
+                  "publish-deb $suite $DEB"
+          done
+
+      - name: wipe secrets
+        if: always()
+        run: rm -f /root/.ssh/id_ed25519_hertz
+
+  # -------------------------------------------------------------------------
+  # libva-v4l2-request-fourier Debian (aarch64) — meson build + dpkg-deb wrap.
+  # -------------------------------------------------------------------------
+  libva-v4l2-request-fourier-debian:
+    needs: libva-v4l2-request-fourier-aarch64
+    # Native Debian trixie runner — the driver bakes __vaDriverInit_1_<MINOR>
+    # at compile time from <va/va.h>.  Building on Arch (libva 2.23) produced
+    # __vaDriverInit_1_23, which trixie's libva 2.22 runtime cannot bind: the
+    # .deb installed but vaInitialize() returned -1 on every host.  A native
+    # trixie runner avoids the cross-distro ABI skew entirely.
+    runs-on: debian-aarch64
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh debian/libva-v4l2-request-fourier)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
+      - name: install build-deps
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          export DEBIAN_FRONTEND=noninteractive
+          retry apt-get update -qq
+          retry apt-get install -y --no-install-recommends \
+              build-essential meson ninja-build pkg-config \
+              libva-dev libdrm-dev \
+              curl openssh-client rsync ca-certificates git dpkg-dev
+
+      - name: install hertz deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
+        env:
+          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
+        run: |
+          mkdir -m700 -p /root/.ssh
+          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
+          chmod 600 /root/.ssh/id_ed25519_hertz
+          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
+
+      - name: build libva-v4l2-request-fourier .deb
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          cd debian/libva-v4l2-request-fourier
+          ./build-deb.sh
+          ls -la *.deb
+
+      - name: upload + publish to suites
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          cd debian/libva-v4l2-request-fourier
+          DEB=$(ls libva-v4l2-request-fourier_*.deb | head -1)
+          retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
+              marfritrepo@hertz.fritz.box:
+          for suite in bookworm trixie; do
+              retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
+                  "publish-deb $suite $DEB"
+          done
+
+      - name: wipe secrets
+        if: always()
+        run: rm -f /root/.ssh/id_ed25519_hertz
+
+  # -------------------------------------------------------------------------
+  # mpv-fourier Debian (aarch64) — meson build links against
+  # ffmpeg-v4l2-request-fourier's libavcodec to keep ABI symmetry between
+  # the .deb's runtime dep declaration and the binary's actual linkage.
+  # We pre-install the Arch sibling package from [marfrit] for that.
+  # -------------------------------------------------------------------------
+  mpv-fourier-debian:
+    needs: mpv-fourier-aarch64
+    runs-on: debian-aarch64
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh debian/mpv-fourier)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
+      - name: install build-deps
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          export DEBIAN_FRONTEND=noninteractive
+          retry apt-get update -qq
+          # Debian libav*-dev is ABI-compatible with the fourier ffmpeg
+          # fork at the header level; mpv link-binds against system
+          # libav at build time, runtime dlopen picks up the fourier
+          # libs if installed.  The previous [marfrit] pre-install of
+          # ffmpeg-v4l2-request-fourier under pacman is unnecessary
+          # under apt: stock Debian libav*-dev provides the trixie
+          # ABI mpv-fourier's binary will encounter.
+          retry apt-get install -y --no-install-recommends \
+              build-essential git meson ninja-build pkg-config python3-docutils \
+              ladspa-sdk wayland-protocols libvulkan-dev libwayland-dev \
+              libasound2-dev desktop-file-utils libc6-dev hicolor-icon-theme \
+              libjack-jackd2-dev liblcms2-dev libarchive-dev libass-dev \
+              libbluray-dev libcdio-dev libcdio-paranoia-dev libdisplay-info-dev \
+              libdrm-dev libdvdnav-dev libdvdread-dev libegl-dev libgl-dev \
+              libglvnd-dev libjpeg-dev libplacebo-dev libpulse-dev libsixel-dev \
+              libva-dev libvdpau-dev libx11-dev libxext-dev libxkbcommon-dev \
+              libxpresent-dev libxrandr-dev libxss-dev libxv-dev libluajit-5.1-dev \
+              libmujs-dev libpipewire-0.3-dev librubberband-dev libsdl2-dev \
+              libopenal-dev libuchardet-dev libvapoursynth-dev liblzma-dev \
+              libavcodec-dev libavformat-dev libavutil-dev libswscale-dev libswresample-dev \
+              zlib1g-dev \
+              curl ca-certificates openssh-client rsync dpkg-dev
+
+      - name: install hertz deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
+        env:
+          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
+        run: |
+          mkdir -m700 -p /root/.ssh
+          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
+          chmod 600 /root/.ssh/id_ed25519_hertz
+          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
+
+      - name: build mpv-fourier .deb
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          cd debian/mpv-fourier
+          ./build-deb.sh
+          ls -la *.deb
+
+      - name: upload + publish to suites
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          cd debian/mpv-fourier
+          DEB=$(ls mpv-fourier_*.deb | head -1)
+          retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
+              marfritrepo@hertz.fritz.box:
+          for suite in bookworm trixie; do
+              retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
+                  "publish-deb $suite $DEB"
+          done
+
+      - name: wipe secrets
+        if: always()
+        run: rm -f /root/.ssh/id_ed25519_hertz
+
+  # -------------------------------------------------------------------------
+  # daedalus-v4l2 Debian (aarch64) — CMake + Make build, dpkg-deb wrap.
+  # Userspace daemon + test tools for the daedalus_v4l2 V4L2-stateless shim.
+  # -------------------------------------------------------------------------
+  daedalus-v4l2-debian:
+    needs: claude-his-debian
+    runs-on: debian-aarch64
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh debian/daedalus-v4l2)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
+      - name: install build-deps
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          export DEBIAN_FRONTEND=noninteractive
+          retry apt-get update -qq
+          # libav*-dev provide the headers daedalus daemon dlopens at
+          # runtime — Debian's stock packages match the trixie ABI the
+          # daemon will encounter on Pi 5 hosts (both ship libavcodec
+          # 61.x).  The fourier ffmpeg fork isn't needed here; the
+          # daemon never link-binds against libav (Option γ — dlopen
+          # at runtime), so any header set with the right struct
+          # definitions works.
+          retry apt-get install -y --no-install-recommends \
+              build-essential cmake ninja-build pkg-config git \
+              libavcodec-dev libavformat-dev libavutil-dev libdrm-dev \
+              linux-libc-dev \
+              curl ca-certificates openssh-client rsync dpkg-dev
+
+      - name: install hertz deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
+        env:
+          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
+        run: |
+          mkdir -m700 -p /root/.ssh
+          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
+          chmod 600 /root/.ssh/id_ed25519_hertz
+          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
+
+      - name: build daedalus-v4l2 .deb
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          cd debian/daedalus-v4l2
+          ./build-deb.sh
+          ls -la *.deb
+
+      - name: upload + publish to suites
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          cd debian/daedalus-v4l2
+          DEB=$(ls daedalus-v4l2_*.deb | head -1)
+          retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
+              marfritrepo@hertz.fritz.box:
+          for suite in bookworm trixie; do
+              retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
+                  "publish-deb $suite $DEB"
+          done
+
+      - name: wipe secrets
+        if: always()
+        run: rm -f /root/.ssh/id_ed25519_hertz
+
+  # -------------------------------------------------------------------------
+  # daedalus-v4l2-dkms Debian (Architecture: all) — packages the kernel
+  # source tree + dkms.conf. No compilation; just file copy + dpkg-deb.
+  # -------------------------------------------------------------------------
+  daedalus-v4l2-dkms-debian:
+    needs: daedalus-v4l2-debian
+    runs-on: debian-aarch64
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh debian/daedalus-v4l2-dkms)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
+      - name: install tooling
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          export DEBIAN_FRONTEND=noninteractive
+          retry apt-get update -qq
+          retry apt-get install -y --no-install-recommends \
+              dpkg-dev openssh-client rsync curl ca-certificates tar gzip
+
+      - name: install hertz deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
+        env:
+          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
+        run: |
+          mkdir -m700 -p /root/.ssh
+          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
+          chmod 600 /root/.ssh/id_ed25519_hertz
+          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
+
+      - name: build daedalus-v4l2-dkms .deb
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          cd debian/daedalus-v4l2-dkms
+          ./build-deb.sh
+          ls -la *.deb
+
+      - name: upload + publish to suites
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          cd debian/daedalus-v4l2-dkms
+          DEB=$(ls daedalus-v4l2-dkms_*.deb | head -1)
+          retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
+              marfritrepo@hertz.fritz.box:
+          for suite in bookworm trixie; do
+              retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
+                  "publish-deb $suite $DEB"
+          done
+
+      - name: wipe secrets
+        if: always()
+        run: rm -f /root/.ssh/id_ed25519_hertz
+
+  # -------------------------------------------------------------------------
+  # mesa-panvk-bifrost (aarch64 only) — patched Mesa libvulkan_panfrost.so
+  # for Bifrost-gen Mali (panvk-bifrost campaign iter9). Co-installs at
+  # /usr/lib/panvk-bifrost/ so stock mesa stays intact; opt-in via the
+  # brave-vulkan launcher this package also ships.
+  #
+  # Build is slow (~30-60min on actrunner-aarch64): full Mesa-from-source.
+  # Standalone job — no `needs:` since it doesn't depend on the fourier
+  # codec stack. continue-on-error so a build hiccup doesn't block other
+  # jobs in the same workflow run.
+  # -------------------------------------------------------------------------
+  mesa-panvk-bifrost-aarch64:
+    runs-on: arch-aarch64
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: skip if already published
+        id: skip-check
+        run: |
+          set -e
+          result=$(./.gitea/scripts/check-already-published.sh arch/mesa-panvk-bifrost)
+          echo "$result" >> "$GITHUB_OUTPUT"
+          echo "decision: $result"
+
+      - name: bootstrap runner (idempotent)
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo
+
+      - name: import signing key
+        if: steps.skip-check.outputs.skip != '1'
+        env:
+          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
+          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
+        run: |
+          set -e
+          gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
+          rm -rf /root/.gnupg /root/repo_pass
+          mkdir -m700 -p /root/.gnupg
+          printf '%s' "$PASS" > /root/repo_pass
+          chmod 600 /root/repo_pass
+          printf '%s\n' "$PRIV" | gpg --batch --import
+          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
+
+      - name: install deploy ssh key
+        if: steps.skip-check.outputs.skip != '1'
+        env:
+          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
+        run: |
+          mkdir -m700 -p /root/.ssh
+          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
+          chmod 600 /root/.ssh/id_ed25519
+          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
+
+      - name: makepkg mesa-panvk-bifrost
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          rm -rf /tmp/build-mesa-panvk-bifrost
+          cp -r arch/mesa-panvk-bifrost /tmp/build-mesa-panvk-bifrost
+          chown -R builder:builder /tmp/build-mesa-panvk-bifrost
+          cd /tmp/build-mesa-panvk-bifrost
+          # MAKEFLAGS for parallel build; runner is multi-core.
+          # --skipinteg because sha256sums=SKIP in PKGBUILD (matches the
+          # fourier-fork PKGBUILD convention).
+          sudo -u builder -H env MAKEFLAGS="-j60" \
+            makepkg --nocheck --noconfirm --syncdeps --cleanbuild --skipinteg
+          ls -la *.pkg.tar.* | grep -v "\.sig$"
+
+      - name: sign mesa-panvk-bifrost
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          cd /tmp/build-mesa-panvk-bifrost
+          for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
+            [ -f "$f" ] || continue
+            gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
+                --detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
+          done
+
+      - name: update aarch64 repo db
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          mkdir -p /tmp/arch-stage-mesa-panvk
+          cd /tmp/arch-stage-mesa-panvk
+          rm -f *
+          for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
+            curl -sSLf "https://packages.reauktion.de/arch/aarch64/$f" -o "$f" || rm -f "$f"
+          done
+          for ext in xz zst gz; do
+            ls /tmp/build-mesa-panvk-bifrost/*.pkg.tar.$ext 2>/dev/null && \
+              mv /tmp/build-mesa-panvk-bifrost/*.pkg.tar.$ext /tmp/build-mesa-panvk-bifrost/*.pkg.tar.$ext.sig .
+          done || true
+          export GNUPGHOME=/root/.gnupg
+          printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
+          printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
+          gpg-connect-agent reloadagent /bye
+          pkgs=()
+          for ext in xz zst gz; do
+            for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
+          done
+          if [ -f marfrit.db.tar.gz ]; then
+            for f in "${pkgs[@]}"; do
+              name=$(echo "$f" | sed -E 's/-[0-9].*//')
+              repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
+                marfrit.db.tar.gz "$name" 2>/dev/null || true
+            done
+          fi
+          repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
+            --verify marfrit.db.tar.gz "${pkgs[@]}"
+          ln -sf marfrit.db.tar.gz        marfrit.db
+          ln -sf marfrit.files.tar.gz     marfrit.files
+          ln -sf marfrit.db.tar.gz.sig    marfrit.db.sig
+          rm -f marfrit.files.sig
+
+      - name: publish to aarch64
+        if: steps.skip-check.outputs.skip != '1'
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          cd /tmp/arch-stage-mesa-panvk
+          retry rsync -avL --copy-unsafe-links \
+            -e 'ssh -i /root/.ssh/id_ed25519' \
+            ./ mfritsche@nc.reauktion.de:arch/aarch64/
+
+      - name: wipe secrets
+        if: always()
+        run: rm -f /root/repo_pass /root/.ssh/id_ed25519
@@ -18,10 +18,12 @@ _module=daedalus_v4l2

 # Same pin as arch/daedalus-v4l2 — keep kernel module + daemon
 # bit-versioned together so the chardev wire protocol stays in sync.
-_commit=f55b2cdab8a8c0bc04e8c1bb1d0b6ca85e7d96d2
+# PROTO_VERSION 0 → 1 at this pin (H.264 B-frame reorder fix); must
+# install both packages atomically.
+_commit=79256dc7ef41f83873ca9c23db20f5888858e65d

-pkgver=0.1.0.r16.f55b2cd
-pkgrel=1
+pkgver=0.1.0.r28.79256dc
+pkgrel=1  # reset for new upstream pin (79256dc — H.264 B-frame reorder fix)
 pkgdesc="V4L2 stateless decoder shim kernel module (DKMS) — Pi 5 / CM5"
 arch=('any')
 url="https://git.reauktion.de/reauktion/daedalus-v4l2"
@@ -16,17 +16,18 @@
 pkgname=daedalus-v4l2
 _upstreampkg=daedalus-v4l2

-# Pin the daedalus-v4l2 tip.  f55b2cd = "Phase 8.13: byte-exact end-to-
-# end via libva (consumer target hit)" — first commit where the full
-# ffmpeg -hwaccel vaapi → libva → /dev/video0 → daemon path lands a
-# pixel-correct decoded frame back in ffmpeg.  Promote to a later pin
-# only after a future phase closes cleanly.
-_commit=f55b2cdab8a8c0bc04e8c1bb1d0b6ca85e7d96d2
+# Pin the daedalus-v4l2 tip.  79256dc = "kernel + daemon: H.264 B-frame
+# display reorder fix (closes #6)" — adds the wire-protocol src_pts /
+# output_src_pts / RESP_FRAME flags split that lets H.264 streams with
+# B-frames preserve display order through libva → kernel → daemon.
+# PROTO_VERSION bumps 0 → 1; lock-step userspace + kernel rebuild
+# REQUIRED (daedalus-v4l2-dkms PKGBUILD pinned to the same commit).
+_commit=79256dc7ef41f83873ca9c23db20f5888858e65d

 # 0.1.0 (pre-1.0) + commit count + short sha.  Bump the .Y on each
 # Phase 8.x close.  pkgver() recomputes at build time.
-pkgver=0.1.0.r16.f55b2cd
-pkgrel=1
+pkgver=0.1.0.r28.79256dc
+pkgrel=1  # reset for new upstream pin (79256dc — H.264 B-frame reorder fix)
 pkgdesc="Userspace daemon for the daedalus-v4l2 V4L2 stateless decoder shim (VP9/AV1/H.264 on Pi 5 / CM5)"
 arch=('aarch64')
 url="https://git.reauktion.de/reauktion/daedalus-v4l2"
@@ -40,9 +41,12 @@ depends=('ffmpeg' 'libdrm')
 makedepends=('cmake' 'ninja' 'pkgconf' 'git' 'ffmpeg')
 optdepends=('daedalus-v4l2-dkms: kernel module providing /dev/video0 + /dev/daedalus-v4l2'
            'libva-v4l2-request-fourier: VA-API consumer routing through this daemon')
+install="${pkgname}.install"

-source=("git+https://git.reauktion.de/reauktion/daedalus-v4l2.git#commit=${_commit}")
-sha256sums=('SKIP')
+source=("git+https://git.reauktion.de/reauktion/daedalus-v4l2.git#commit=${_commit}"
+        "${pkgname}.install")
+sha256sums=('SKIP'
+            'SKIP')

 pkgver() {
    cd "${srcdir}/${_upstreampkg}"
@@ -83,6 +87,14 @@ package() {
    install -Dm644 include/daedalus_v4l2_proto.h \
        "${pkgdir}/usr/include/daedalus_v4l2_proto.h"

+    # systemd unit + module autoload — without these the daemon never
+    # starts and the libva/VAAPI consumer's REQ_DECODE has nobody on
+    # the other end of /dev/daedalus-v4l2.
+    install -Dm644 packaging/systemd/daedalus-v4l2.service \
+        "${pkgdir}/usr/lib/systemd/system/daedalus-v4l2.service"
+    install -Dm644 packaging/systemd/daedalus-v4l2.modules-load \
+        "${pkgdir}/usr/lib/modules-load.d/daedalus-v4l2.conf"
+
    # Documentation
    install -Dm644 README.md \
        "${pkgdir}/usr/share/doc/${pkgname}/README.md"
@@ -0,0 +1,42 @@
+# post_install / post_upgrade for daedalus-v4l2.
+#
+# Enables (but doesn't start — leave that to the operator) the
+# daemon service so it comes up on next boot.  Reloads systemd
+# so the new unit file is visible.  Triggers modules-load so the
+# kernel module loads without a reboot if daedalus-v4l2-dkms is
+# also installed.
+
+_activate() {
+    systemctl daemon-reload >/dev/null 2>&1 || true
+    systemctl enable daedalus-v4l2.service >/dev/null 2>&1 || true
+
+    # Trigger /usr/lib/modules-load.d/daedalus-v4l2.conf without a
+    # reboot.  Safe if the module is already loaded.
+    systemd-modules-load >/dev/null 2>&1 || true
+
+    cat >&2 <<EOF
+==> daedalus-v4l2: service enabled, will start on next boot.
+==> To start now (requires the kernel module to be loaded):
+==>   sudo systemctl start daedalus-v4l2.service
+==> Verify decode path:
+==>   journalctl -u daedalus-v4l2.service -f
+EOF
+}
+
+post_install() {
+    _activate
+}
+
+post_upgrade() {
+    _activate
+    systemctl try-restart daedalus-v4l2.service >/dev/null 2>&1 || true
+}
+
+pre_remove() {
+    systemctl stop daedalus-v4l2.service    >/dev/null 2>&1 || true
+    systemctl disable daedalus-v4l2.service >/dev/null 2>&1 || true
+}
+
+post_remove() {
+    systemctl daemon-reload >/dev/null 2>&1 || true
+}
@@ -18,27 +18,30 @@ This patch adds a sibling init path, `InitV4L2RequestDecoder`, that:
  * looks up the codec via two complementary mechanisms libavcodec
    uses for v4l2_request:
      - **named codec** (`h264_v4l2request`, `vp8_v4l2request`, etc.):
-        the legacy AVCodec-per-hwaccel registration. ALARM, Debian,
-        and most distros building with --enable-v4l2-request expose
-        this (avcodec_find_decoder_by_name lookup).
-      - **generic codec + AV_HWDEVICE_TYPE_DRM** in `hw_configs`:
-        the modern hwaccel registration on some upstream-only ffmpeg
-        builds.
+        the legacy AVCodec-per-hwaccel registration.
+      - **generic codec + hw_configs walk**: the modern hwaccel
+        registration. Accepts EITHER AV_HWDEVICE_TYPE_DRM (legacy
+        ffmpeg-v4l2-request-fork output prior to FFmpeg 7.1) OR
+        AV_HWDEVICE_TYPE_V4L2REQUEST (FFmpeg 7.1+ dedicated enum,
+        value 13 on Kwiboo's no-AMF tree, 14 on upstream-AMF tree).
+        Mozilla's bundled libavutil headers may not have the V4L2REQUEST
+        enumerator, so the test is on the integer value via `(int)cast`.
    Probes named-codec first (explicit, portable) and falls back to
-    walking the generic codec's `hw_configs` for the DRM device type;
-  * creates an `AV_HWDEVICE_TYPE_DRM` hwdevice context bound to
-    `/dev/dri/renderD128` via the new `av_hwdevice_ctx_create` wrapper
-    (patch 2/4) and attaches it to the codec context;
+    walking the generic codec's `hw_configs` for either device type;
+  * creates an hwdevice context bound to `/dev/dri/renderD128`. Uses
+    integer 13 (V4L2REQUEST as defined by Kwiboo's v4l2-request-n7.1.3
+    tree, what our libavcodec61-fourier emits) cast to enum
+    AVHWDeviceType for the av_hwdevice_ctx_create call;
  * reuses the existing `ChooseV4L2PixelFormat` get-format callback
    (already returns `AV_PIX_FMT_DRM_PRIME`) and the existing
    `apply_cropping = 0` constraint.

 `InitV4L2RequestDecoder` is invoked **before** `InitV4L2Decoder` in
 `InitHWDecoderIfAllowed`. On Rockchip mainline it succeeds via either
-mechanism (ALARM uses the named codec). On Pi4 / Mediatek /
-vendor-MPP-stateful boards neither mechanism is registered for the
-codec, the function bails out, and the existing stateful
-`InitV4L2Decoder` runs as before. No regression of stateful boards.
+mechanism. On Pi4 / Mediatek / vendor-MPP-stateful boards neither
+mechanism is registered for the codec, the function bails out, and the
+existing stateful `InitV4L2Decoder` runs as before. No regression of
+stateful boards.

 `mDRMDeviceContext` is unconditionally `av_buffer_unref`'d in
 `ProcessShutdown` (no-op when null). Gated behind
@@ -46,9 +49,8 @@ codec, the function bails out, and the existing stateful

 Bug 1969297.

-diff --git a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h b/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h
--- a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h	2026-03-18 19:22:14.000000000 +0000
-+++ b/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h	2026-04-27 20:43:39.347992674 +0000
+--- a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h	2026-05-21 04:57:59.570946601 +0000
+++ b/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h	2026-05-21 04:57:59.876488776 +0000
@@ -225,7 +225,12 @@
   bool IsLinuxHDR() const;
   MediaResult InitVAAPIDecoder();
@@ -73,9 +75,8 @@ diff --git a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h b/dom/media/platfor
   // If video overlay is used we want to upload SW decoded frames to
   // DMABuf and present it as a external texture to rendering pipeline.
   bool mUploadSWDecodeToDMABuf = false;
-diff --git a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp b/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp
--- a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp	2026-04-27 16:09:10.000000000 +0200
-+++ b/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp	2026-04-29 00:10:00.098884335 +0200
+--- a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp	2026-05-21 04:57:59.566685221 +0000
+++ b/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp	2026-05-21 04:58:00.136004159 +0000
@@ -403,6 +403,129 @@
   return NS_OK;
 }
@@ -90,7 +91,7 @@ diff --git a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp b/dom/media/platf
 +  }
 +  const char* drmDevice = "/dev/dri/renderD128";
 +  if (mLib->av_hwdevice_ctx_create(&mDRMDeviceContext,
-+                                   AV_HWDEVICE_TYPE_DRM, drmDevice,
+                                   (enum AVHWDeviceType)13, drmDevice,
 +                                   nullptr, 0) < 0) {
 +    FFMPEG_LOG("  av_hwdevice_ctx_create(DRM, %s) failed", drmDevice);
 +    return false;
@@ -143,7 +144,7 @@ diff --git a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp b/dom/media/platf
 +      for (int i = 0;; i++) {
 +        const AVCodecHWConfig* cfg = mLib->avcodec_get_hw_config(generic, i);
 +        if (!cfg) break;
-+        if (cfg->device_type == AV_HWDEVICE_TYPE_DRM) {
+        if (cfg->device_type == AV_HWDEVICE_TYPE_DRM || (int)cfg->device_type == 13 || (int)cfg->device_type == 14) {
 +          codec = generic;
 +          FFMPEG_LOG("  using generic codec %s with DRM hwaccel", codec->name);
 +          break;
@@ -13,7 +13,7 @@

 pkgname=firefox-fourier
 pkgver=150.0.1
-pkgrel=5
+pkgrel=7
 pkgdesc='Firefox with V4L2 stateless HW video decode unlocked for mainline Linux Rockchip'
 arch=('aarch64' 'x86_64')
 url='https://www.mozilla.org/firefox'
@@ -91,8 +91,11 @@ source=(
  # Vendor-default prefs that gate the patched VAAPI path on RK3399 —
  # widget.dmabuf.force-enabled etc. See marfrit-packages#8 for evidence.
  'rockchip-fourier-defaults.js'
+  # Plasma/GNOME start-menu entry — categorises under Internet, picks the
+  # 128px firefox icon shipped under /usr/lib/firefox-fourier/browser/.
+  'firefox-fourier.desktop'
 )
-sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
+sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')

 prepare() {
  cd "${srcdir}/firefox-${pkgver}"
@@ -180,4 +183,11 @@ LAUNCHER
  # VAAPI_VLD` + dmabuf surfaces locking end-to-end.
  install -Dm644 "${srcdir}/rockchip-fourier-defaults.js" \
    "${pkgdir}/usr/lib/firefox-fourier/defaults/preferences/rockchip-fourier-defaults.js"
+
+  # Desktop entry — fileless install would leave the package without a
+  # start-menu entry (stock firefox.desktop disappears when our `provides`
+  # replaces stock firefox). Plasma & GNOME pick this up via the
+  # `Categories=Network;WebBrowser;` line → "Internet" submenu.
+  install -Dm644 "${srcdir}/firefox-fourier.desktop" \
+    "${pkgdir}/usr/share/applications/firefox-fourier.desktop"
 }
@@ -0,0 +1,22 @@
+[Desktop Entry]
+Version=1.0
+Type=Application
+Name=Firefox (Fourier — V4L2 HW decode)
+GenericName=Web Browser
+Comment=Browse the Web with V4L2 stateless HW video decode (RK3588/RK3566)
+Exec=/usr/bin/firefox-fourier %u
+Icon=/usr/lib/firefox-fourier/browser/chrome/icons/default/default128.png
+Terminal=false
+StartupNotify=true
+StartupWMClass=firefox-fourier
+Categories=Network;WebBrowser;
+MimeType=text/html;text/xml;application/xhtml+xml;application/vnd.mozilla.xul+xml;application/rss+xml;application/rdf+xml;image/gif;image/jpeg;image/png;image/svg+xml;image/webp;image/avif;application/json;application/pdf;audio/flac;audio/ogg;audio/webm;video/ogg;video/webm;x-scheme-handler/http;x-scheme-handler/https;x-scheme-handler/chrome;x-scheme-handler/mailto;
+Actions=new-window;new-private-window;
+
+[Desktop Action new-window]
+Name=Open a New Window
+Exec=/usr/bin/firefox-fourier --new-window %u
+
+[Desktop Action new-private-window]
+Name=Open a New Private Window
+Exec=/usr/bin/firefox-fourier --private-window %u
@@ -34,3 +34,20 @@ ac_add_options --with-distribution-id=de.reauktion.fourier

 # Reduce build memory pressure on aarch64 — parallel link is heavy.
 mk_add_options MOZ_PARALLEL_BUILD=8
+
+# Explicit distcc routing. fermi's makepkg.conf has
+# BUILDENV=(distcc ...) which auto-prepends /usr/lib/distcc/bin to
+# $PATH, but mach's configure picks up CC/CXX from the env directly
+# and the distcc wrappers won't fire unless we set them. Mirrors the
+# ffmpeg-v4l2-request-fourier pattern.
+#
+# Note: only the C/C++ portion of the build distributes; rustc and
+# the host-only build steps stay local. Empirically that's still a
+# 30-40% wall-clock win on a 4-worker pool. DISTCC_HOSTS comes from
+# makepkg.conf ('+zeroconf' by default — Avahi-discovers tesla,
+# dcc1, dcc2, ampere).
+if [[ ":${PATH}:" == *":/usr/lib/distcc/bin:"* ]]; then
+    export CC="distcc gcc"
+    export CXX="distcc g++"
+fi
+
@@ -21,27 +21,32 @@
 # Alternative: boltzmann via his subagent + marfrit-publish.

 pkgname=libva-v4l2-request-fourier
+epoch=1
 _upstreampkg=libva-v4l2-request

-# Pin the fork tip. de27e95 = "v4l2: log error_idx + failing ctrl id
-# on S_EXT_CTRLS failure" — Phase 8.13 diagnostic that surfaced the
-# real root cause of the libva→daedalus_v4l2 request-completion
-# timeout (turned out the EINVAL libva was logging was a harmless
-# H264/HEVC probe; actual VP9 stateless control SET worked all along).
+# Pin the fork tip. c454618 = PR #16 merge "picture, request_pool:
+# transparent OUTPUT-pool resize on bitstream overrun (#15)" —
+# follow-up root-cause fix to #13/#14. On a mid-stream bitstream-
+# budget overrun (typical cause: SPS-driven resolution upshift in an
+# adaptive-bitrate stream), codec_store_buffer now snapshots the in-
+# flight surface's accumulated bytes, releases its OUTPUT pool slot,
+# calls request_pool_resize (STREAMOFF → REQBUFS(0) → S_FMT with
+# 2×sizeimage hint, capped at 1 GiB, page-aligned → CREATE_BUFS →
+# mmap → media_request_alloc → STREAMON), re-acquires a slot, re-
+# mirrors the surface's source_{data,size,request_fd}, restores the
+# bytes, and continues. The frame survives instead of being dropped
+# back to libavcodec for surface recreation. CAPTURE side untouched
+# (per-queue V4L2 streaming independence).
 #
-# Prior pin (7ac934e) was iter38b — fresnel-fourier multi-device probe
-# + MAX_PROFILES bounds-check fix. de27e95 adds the daedalus_v4l2
-# probe slot (b5b3acf), the meson option gate (2146341), and the
-# S_EXT_CTRLS diagnostic (de27e95 itself). Backward-compatible on
-# rkvdec / hantro / cedrus / rpi-hevc-dec hosts — daedalus probe is
-# off by default unless the kernel module is present.
-_commit=de27e95571b67ef34619c23a12db4698f9b3454e
+# Prior pin (2860d75) = PR #14 merge — codec_store_buffer bounds-
+# check floor (#13).
+_commit=c454618ae11addce2e17b560f4deeacbed067d98

 # Project version from meson.build (1.0.0) + commit count + short sha,
 # matching the ffmpeg-v4l2-request-fourier convention. Recomputed at
 # build time by pkgver() below; the static value here is a placeholder
 # so AUR-style consumers see something coherent before src/ exists.
-pkgver=1.0.0.r376.de27e95
+pkgver=1.0.0.r390.c454618
 pkgrel=1
 pkgdesc="VA-API backend for V4L2 stateless decoders (multiplanar fork — fourier umbrella)"
 arch=('aarch64')
@@ -0,0 +1,19 @@
+# makepkg outputs and intermediate state
+src/
+pkg/
+*.pkg.tar.zst
+*.pkg.tar.zst.sig
+*-build.log*
+*-prepare.log
+*-package_*.log
+*.tar.xz
+*.tar.sign
+*.patch.zst
+*.patch.zst.sig
+logpipe.*
+
+# build-time artifacts that must never be committed
+src/
+*.tar.xz
+*.tar.zst
+pkg/
@@ -0,0 +1,247 @@
+# Maintainer: Markus Fritsche <fritsche.markus@gmail.com>
+# Forked from: linux-pinetab2 by Danct12 <danct12@disroot.org>
+# Original Contributor: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+#
+# linux-pinetab2-danctnix-besser: linux-pinetab2 + the BESser bes2600
+# driver patchset.  Soft-upstream fork of linux-pinetab2 — drop-in
+# replacement, same kernel version, only the bes2600 staging driver
+# differs.  See git.reauktion.de/marfrit/besser and
+# git.reauktion.de/marfrit/bes2600-dkms for full provenance.
+#
+# ─────────────────────────────────────────────────────────────────────
+# kernel-agent flow (effective pkgrel=4):
+#
+# The single 0001-bes2600-besser-kernel-agent-cumulative.patch is
+# regenerated by `ka-promote ohm` in
+# git.reauktion.de/marfrit/kernel-agent against fleet/ohm.yaml.  Its
+# b2sum below MUST match the cumulative.b2sum recorded in the
+# co-located manifest.lock.  Sibling manifest.lock pins the source-of-
+# truth manifest sha256 and per-include patch sha256s.
+#
+# To update for a new patch in the manifest:
+#   1. Edit kernel-agent:fleet/ohm.yaml (add/remove includes)
+#   2. `ka-promote ohm` → writes new cumulative.patch + manifest.lock
+#      to kernel-agent/build/ohm/v7.0-danctnix1/
+#   3. Copy both files into this directory (replacing existing ones)
+#   4. Update the b2sum in this PKGBUILD for the cumulative
+#   5. Bump pkgrel
+# ─────────────────────────────────────────────────────────────────────
+
+pkgbase=linux-pinetab2-danctnix-besser
+pkgver=7.0.danctnix1
+pkgrel=5
+pkgdesc='PineTab2 (BESser bes2600 driver patchset, kernel-agent managed)'
+_srcname=linux-pinetab2
+_srctag=v${pkgver%.*}-${pkgver##*.}
+arch=(aarch64)
+_url_git="https://codeberg.org/DanctNIX/${_srcname}"
+url="${_url_git}/commits/tag/$_srctag"
+license=(GPL-2.0-only)
+makedepends=(
+  bc
+  cpio
+  gettext
+  git
+  libelf
+  pahole
+  perl
+  python
+  tar
+  xz
+)
+options=(
+  !debug
+  !strip
+)
+source=(
+  https://cdn.kernel.org/pub/linux/kernel/v${pkgver%%.*}.x/linux-${pkgver%.*}.tar.{xz,sign}
+  ${_url_git}/releases/download/${_srctag}/${_srctag}.patch.zst{,.sig}
+  0001-bes2600-besser-kernel-agent-cumulative.patch
+  config
+)
+validpgpkeys=(
+  ABAF11C65A2970B130ABE3C479BE3E4300411886  # Linus Torvalds
+  647F28654894E3BD457199BE38DBBDC86092693E  # Greg Kroah-Hartman
+  F09A933C0FE0331E558CA4E166CAB7EAA45DD781  # Danct12
+)
+b2sums=('3d9795083c8938f80f480de0d10bfd9c525640e59d5c7f22983de3f12ee42c84c31be902cafb05579ddb1c32bac5ed06b0d4953f9705450be185bd2d9ab08f89'
+        'SKIP'
+        '71fe98221e802b315e54b4b10d3e8c8f376695a36bae3541d876e5776a37f3fa33c8f8dfa6e51fcbd6f5396add02e5166634165f2351836a0ea0453c172fe56c'
+        'SKIP'
+        '50397711a6a3ba522283685a9e7397aeed6663f353f7cba214d4bb88bc98516065b2fca9a36ce13c52644617879f69f39c5305e86db5d9fb25c4dae5434eb9c4'
+        '656a998ab40cb85ee4c00f087b071a91632a6c091da2c84b0f74236b51d2dea6e9db6886625f80ad81dc249d8494ec47cd79d6dd9ea4f5e44f3cde857f861e10')
+
+export KBUILD_BUILD_HOST=archlinux
+export KBUILD_BUILD_USER=$pkgbase
+export KBUILD_BUILD_TIMESTAMP="$(date -Ru${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH})"
+
+prepare() {
+  cd linux-${pkgver%.*}
+
+  echo "Setting version..."
+  echo "-$pkgrel" > localversion.10-pkgrel
+  echo "${pkgbase#linux}" > localversion.20-pkgname
+
+  local src
+  for src in "${source[@]}"; do
+      src="${src%%::*}"
+      src="${src##*/}"
+      src="${src%.zst}"
+      [[ $src = *.patch ]] || continue
+      echo "Applying patch: $src..."
+      patch -Np1 < "../$src"
+  done
+
+  echo "Setting config..."
+  cp ../config .config
+  make olddefconfig
+  diff -u ../config .config || :
+
+  make -s kernelrelease > version
+  echo "Prepared $pkgbase version $(<version)"
+}
+
+build() {
+  cd linux-${pkgver%.*}
+  make DTC_FLAGS="-@" all
+  make -C tools/bpf/bpftool vmlinux.h feature-clang-bpf-co-re=1
+}
+
+_package() {
+  pkgdesc="The $pkgdesc kernel and modules"
+  depends=(
+    coreutils
+    kmod
+    mkinitcpio
+  )
+  optdepends=(
+    'wireless-regdb: to set the correct wireless channels of your country'
+    'linux-firmware: firmware images needed for some devices'
+  )
+  provides=(
+    KSMBD-MODULE
+    WIREGUARD-MODULE
+    "linux-pinetab2=$pkgver-$pkgrel"
+  )
+  conflicts=(linux-pinetab2)
+  replaces=(
+    wireguard-arch
+  )
+
+  cd linux-${pkgver%.*}
+  local modulesdir="$pkgdir/usr/lib/modules/$(<version)"
+
+  echo "Installing boot image..."
+  # systemd expects to find the kernel here to allow hibernation
+  # https://github.com/systemd/systemd/commit/edda44605f06a41fb86b7ab8128dcf99161d2344
+  install -Dm644 "$(make -s image_name)" "$modulesdir/vmlinuz"
+
+  # Used by mkinitcpio to name the kernel
+  echo "$pkgbase" | install -Dm644 /dev/stdin "$modulesdir/pkgbase"
+
+  echo "Installing modules..."
+  ZSTD_CLEVEL=19 make INSTALL_MOD_PATH="$pkgdir/usr" INSTALL_MOD_STRIP=1 \
+    DEPMOD=/doesnt/exist modules_install  # Suppress depmod
+
+  echo "Installing device trees..."
+  make INSTALL_DTBS_PATH="$pkgdir/boot/dtbs" dtbs_install
+
+  # Removing unnecessary device trees (keep only pinetab2 variants).
+  # find -delete is robust to nullglob/cwd quirks where a bash for-loop
+  # silently no-op'd in the makepkg environment.
+  find "$pkgdir"/boot/dtbs/rockchip/ -mindepth 1 -maxdepth 1 -type f \
+       ! -name 'rk3566-pinetab2-*' -delete
+
+  # remove build link
+  rm "$modulesdir"/build
+}
+
+_package-headers() {
+  pkgdesc="Headers and scripts for building modules for the $pkgdesc kernel"
+  depends=(pahole)
+
+  cd linux-${pkgver%.*}
+  local builddir="$pkgdir/usr/lib/modules/$(<version)/build"
+
+  echo "Installing build files..."
+  install -Dt "$builddir" -m644 .config Makefile Module.symvers System.map \
+    localversion.* version vmlinux tools/bpf/bpftool/vmlinux.h
+  install -Dt "$builddir/kernel" -m644 kernel/Makefile
+  install -Dt "$builddir/arch/arm64" -m644 arch/arm64/Makefile
+  cp -t "$builddir" -a scripts
+
+  # required when DEBUG_INFO_BTF_MODULES is enabled
+  install -Dt "$builddir/tools/bpf/resolve_btfids" tools/bpf/resolve_btfids/resolve_btfids
+
+  echo "Installing headers..."
+  cp -t "$builddir" -a include
+  cp -t "$builddir/arch/arm64" -a arch/arm64/include
+  install -Dt "$builddir/arch/arm64/kernel" -m644 arch/arm64/kernel/asm-offsets.s
+
+  install -Dt "$builddir/drivers/md" -m644 drivers/md/*.h
+  install -Dt "$builddir/net/mac80211" -m644 net/mac80211/*.h
+
+  # https://bugs.archlinux.org/task/13146
+  install -Dt "$builddir/drivers/media/i2c" -m644 drivers/media/i2c/msp3400-driver.h
+
+  # https://bugs.archlinux.org/task/20402
+  install -Dt "$builddir/drivers/media/usb/dvb-usb" -m644 drivers/media/usb/dvb-usb/*.h
+  install -Dt "$builddir/drivers/media/dvb-frontends" -m644 drivers/media/dvb-frontends/*.h
+  install -Dt "$builddir/drivers/media/tuners" -m644 drivers/media/tuners/*.h
+
+  # https://bugs.archlinux.org/task/71392
+  install -Dt "$builddir/drivers/iio/common/hid-sensors" -m644 drivers/iio/common/hid-sensors/*.h
+
+  echo "Installing KConfig files..."
+  find . -name 'Kconfig*' -exec install -Dm644 {} "$builddir/{}" \;
+
+  echo "Removing unneeded architectures..."
+  local arch
+  for arch in "$builddir"/arch/*/; do
+    [[ $arch = */arm64/ ]] && continue
+    echo "Removing $(basename "$arch")"
+    rm -r "$arch"
+  done
+
+  echo "Removing documentation..."
+  rm -r "$builddir/Documentation"
+
+  echo "Removing broken symlinks..."
+  find -L "$builddir" -type l -printf 'Removing %P\n' -delete
+
+  echo "Removing loose objects..."
+  find "$builddir" -type f -name '*.o' -printf 'Removing %P\n' -delete
+
+  echo "Stripping build tools..."
+  local file
+  while read -rd '' file; do
+    case "$(file -Sib "$file")" in
+      application/x-sharedlib\;*)      # Libraries (.so)
+        strip -v $STRIP_SHARED "$file" ;;
+      application/x-archive\;*)        # Libraries (.a)
+        strip -v $STRIP_STATIC "$file" ;;
+      application/x-executable\;*)     # Binaries
+        strip -v $STRIP_BINARIES "$file" ;;
+      application/x-pie-executable\;*) # Relocatable binaries
+        strip -v $STRIP_SHARED "$file" ;;
+    esac
+  done < <(find "$builddir" -type f -perm -u+x ! -name vmlinux -print0)
+
+  echo "Stripping vmlinux..."
+  strip -v $STRIP_STATIC "$builddir/vmlinux"
+
+  echo "Adding symlink..."
+  mkdir -p "$pkgdir/usr/src"
+  ln -sr "$builddir" "$pkgdir/usr/src/$pkgbase"
+}
+
+pkgname=(
+  "$pkgbase"
+  "$pkgbase-headers"
+)
+for _p in "${pkgname[@]}"; do
+  eval "package_$_p() {
+    $(declare -f "_package${_p#$pkgbase}")
+    _package${_p#$pkgbase}
+  }"
+done
@@ -0,0 +1,52 @@
+# linux-pinetab2-danctnix-besser
+
+DanctNIX PineTab2 kernel + the BESser bes2600 driver patchset.
+**kernel-agent managed** as of pkgrel=4 (2026-05-18).
+
+## TL;DR
+
+- **What**: drop-in replacement for `linux-pinetab2` with the BESser
+  bes2600 patchset applied.
+- **For**: PineTab2 (RK3566) with the on-board BES2600 SDIO WiFi/BT chip.
+- **Install**: `pacman -U linux-pinetab2-danctnix-besser-*.pkg.tar.zst
+  linux-pinetab2-danctnix-besser-headers-*.pkg.tar.zst`. It `provides`
+  and `conflicts` with `linux-pinetab2`, so it slots in cleanly.
+- **Source of truth for patches**:
+  [git.reauktion.de/marfrit/kernel-agent](https://git.reauktion.de/marfrit/kernel-agent)
+  `fleet/ohm.yaml`.
+
+## How the patch cumulative is built
+
+1. `kernel-agent/fleet/ohm.yaml` lists the patch series-dir includes
+   for this kernel.
+2. `kernel-agent/bin/ka-promote ohm` walks those includes, concatenates
+   them into a single `cumulative.patch`, and emits a `manifest.lock`
+   recording per-patch sha256s and the cumulative b2sum.
+3. The cumulative is dropped into this directory as
+   `0001-bes2600-besser-kernel-agent-cumulative.patch`, the b2sum in
+   `PKGBUILD` is updated to match, and `pkgrel` is bumped.
+4. `manifest.lock` is committed alongside the cumulative for an
+   audit trail (which patches went in, in what order).
+
+## pkgrel history
+
+| pkgrel | Date       | Notes                                           |
+|--------|------------|-------------------------------------------------|
+| 1–3    | 2026-05-08…05-18 | hand-managed in `marfrit/besser/danctnix-besser-pkgbuild/` (DEPRECATED) |
+| 4      | 2026-05-18 | first kernel-agent-managed release; same source contents as the hand-managed pkgrel=3 (Patch I + SCS workaround folded into single cumulative); fixes pkgrel=3's duplicated `0003-arm64-...patch` source-array bug |
+
+## Known caveats
+
+- **`CONFIG_SHADOW_CALL_STACK=n`** in the config: GCC 15.2.1 fails to
+  build `arch/arm64/lib/xor-neon.c` with `arm_neon.h` `#pragma GCC
+  target()` blocks and `-fsanitize=shadow-call-stack`. See
+  `reference_arm64_scs_arm_neon_gcc15` memory and the Makefile
+  workaround patch included in the cumulative. Track upstream GCC
+  resolution before re-enabling.
+- The `cumulative-c5x-danctnix` series-dir in kernel-agent is currently
+  a single-file interim (the working hand-curated cumulative) because
+  the per-series mirrors created in `kernel-agent#17` use DKMS-style
+  root paths instead of in-tree staging paths and do not apply
+  cleanly. Per-series reconstruction is a separate kernel-agent
+  follow-up. The b2sum integrity check in `PKGBUILD` still pins the
+  exact bytes shipped.
@@ -0,0 +1,37 @@
+baseline:
+  ref: v7.0-danctnix1
+  tree: DanctNIX/linux-pinetab2
+  upstream_compat: linux-7.0
+  url: https://codeberg.org/DanctNIX/linux-pinetab2
+cumulative:
+  b2sum: 50397711a6a3ba522283685a9e7397aeed6663f353f7cba214d4bb88bc98516065b2fca9a36ce13c52644617879f69f39c5305e86db5d9fb25c4dae5434eb9c4
+  path: cumulative.patch
+  size: 162716
+generated_at: '2026-05-18T17:16:06.455474+00:00'
+host: ohm
+ka_promote_version: 1
+manifest:
+  path: fleet/ohm.yaml
+  sha256: da59ac2c965e5ad9c5004a115b10a37abf47ed3ecc8b7f5ab426470d2ee7b442
+resolved_patches:
+- apply_order: 1
+  from_series: true
+  include: driver/bes2600/cumulative-c5x-danctnix/0001-bes2600-besser-cumulative-series.patch
+  sha256: e477a170567487fef84fe13be5b0a1f0498247ff1f201000d0085a2e49ff9026
+  size: 148149
+- apply_order: 2
+  from_series: true
+  include: driver/bes2600/scan-filter-5ghz-danctnix/0001-bes2600-filter-5ghz-scan-and-allow-single-channel.patch
+  sha256: 31e67569e00daead0784214aced1e077d3270cf1407baa0b330d474e17ec3931
+  size: 7735
+- apply_order: 3
+  from_series: true
+  include: arch/arm64/xor-neon-ffixed-x18-scs-build-fix-danctnix/0001-arm64-xor-neon-ffixed-x18-build-fix.patch
+  sha256: a49c50f0ebffc499970c24908b832c3e61c96ed87de35b3a82178eff587f94f1
+  size: 1574
+- apply_order: 4
+  from_series: true
+  include: driver/bes2600/queue-pending-record-lock-bh-danctnix/0001-bes2600-take-pending-record-lock-with-bh.patch
+  sha256: 089862e5f6da5783ed0db979144e4fa07cff7f743809a0bebd715c75a3bb8eb5
+  size: 5258
+schema_version: 1
@@ -0,0 +1,57 @@
+From: claude-noether (on behalf of mfritsche)
+Date: 2026-05-19
+Subject: panvk: expose VK_KHR/EXT_robustness2 + nullDescriptor on Bifrost (PAN_ARCH 6/7)
+
+Without this, Mesa's Zink driver refuses to use PanVk-Bifrost as its Vulkan
+backend, falling back silently to llvmpipe (software rasterizer) for all
+GL-via-Zink on Bifrost SBCs. That defeats the entire purpose of having a
+Vulkan driver on Bifrost — GL acceleration via Zink is the most natural
+near-term consumer.
+
+panvk_vX_nir_lower_descriptors.c:1309 and panvk_vX_shader.c:1355 already
+plumb dev->vk.enabled_features.nullDescriptor arch-agnostically — the gate
+at panvk_vX_physical_device.c was set conservatively when Bifrost was
+unmaintained, not because of hardware incapability.
+
+iter1–7 of the panvk-bifrost campaign proved fundamental driver functions
+on Mali-G52 r1 MC1 (PAN_ARCH=7). This patch is the iter8 follow-up.
+
+robustBufferAccess2 and robustImageAccess2 are NOT flipped — they're
+independent rb2 features Zink doesn't require, gated differently
+(robustBufferAccess2 = PAN_ARCH >= 11, robustImageAccess2 = false), and
+out of scope for iter8.
+
+---
+ src/panfrost/vulkan/panvk_vX_physical_device.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/panfrost/vulkan/panvk_vX_physical_device.c b/src/panfrost/vulkan/panvk_vX_physical_device.c
+--- a/src/panfrost/vulkan/panvk_vX_physical_device.c
+++ b/src/panfrost/vulkan/panvk_vX_physical_device.c
+@@ -91,7 +91,7 @@ get_device_extensions(const struct panvk_physical_device *device,
+       .KHR_pipeline_binary = true,
+       .KHR_pipeline_executable_properties = true,
+       .KHR_pipeline_library = true,
+-      .KHR_robustness2 = PAN_ARCH >= 10,
+      .KHR_robustness2 = true,
+       .KHR_sampler_mirror_clamp_to_edge = true,
+       .KHR_sampler_ycbcr_conversion = true,
+       .KHR_separate_depth_stencil_layouts = true,
+@@ -168,7 +168,7 @@ get_device_extensions(const struct panvk_physical_device *device,
+       .EXT_queue_family_foreign = true,
+       .EXT_robustness = pan_arch(device->kmod.dev->props.gpu_id) >= 9,
+       .EXT_image_robustness = true,
+-      .EXT_robustness2 = PAN_ARCH >= 10,
+      .EXT_robustness2 = true,
+       .EXT_sampler_filter_minmax = PAN_ARCH >= 10,
+       .EXT_scalar_block_layout = true,
+       .EXT_separate_stencil_usage = true,
+@@ -493,7 +493,7 @@ get_device_features(const struct panvk_physical_device *device,
+       /* VK_KHR_robustness2 */
+       .robustBufferAccess2 = PAN_ARCH >= 11,
+       .robustImageAccess2 = false,
+-      .nullDescriptor = PAN_ARCH >= 10,
+      .nullDescriptor = true,
+
+       /* VK_KHR_shader_clock */
+       .shaderSubgroupClock = device->kmod.dev->props.gpu_can_query_timestamp,
@@ -0,0 +1,47 @@
+From: claude-noether (on behalf of mfritsche)
+Date: 2026-05-20
+Subject: panvk: expose Vulkan 1.1 + 1.2 on Bifrost (PAN_ARCH 6/7)
+
+ANGLE (Chromium's GL stack) requires apiVersion >= 1.1 to initialize. Without
+this, Brave / Chromium's GPU process fails at GL info collection:
+
+  vk_renderer.cpp:2659 (initialize): ANGLE Requires a minimum Vulkan device
+                                     version of 1.1
+  Display::initialize error 0: Internal Vulkan error (-9): The requested
+                               version of Vulkan is not supported by the driver
+
+Stack-up with iter8's robustness2 patch enables ANGLE → PanVk-Bifrost →
+Skia (via --enable-features=Vulkan) on Bifrost SBCs.
+
+PanVk-Bifrost already supports the bulk of 1.1-promoted features as extensions
+(multiview, maintenance1-3, descriptor update template, 16-bit storage,
+descriptor update template, sampler ycbcr, variable pointers, etc. — all
+visible in iter0 vulkaninfo). The version bump primarily bundles them.
+
+Risk: Vulkan 1.1 has features beyond what iter1–7 exercised (protected memory,
+full subgroup ops). Specific app failures will be characterizable.
+
+1.2 is also flipped — Brave's Vulkan path may want descriptor indexing,
+buffer device address, etc. (all listed in iter0 vulkaninfo as supported
+extensions, just gated as 1.0-with-extensions, not 1.2-core).
+
+---
+ src/panfrost/vulkan/panvk_vX_physical_device.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/panfrost/vulkan/panvk_vX_physical_device.c b/src/panfrost/vulkan/panvk_vX_physical_device.c
+--- a/src/panfrost/vulkan/panvk_vX_physical_device.c
+++ b/src/panfrost/vulkan/panvk_vX_physical_device.c
+@@ -38,8 +38,8 @@ get_device_extensions(const struct panvk_physical_device *device,
+                       struct vk_device_extension_table *ext)
+ {
+    *ext = (struct vk_device_extension_table){
+-      .KHR_8bit_storage = true,
+-      .KHR_16bit_storage = true,
+-      bool has_vk1_1 = PAN_ARCH >= 10;
+-      bool has_vk1_2 = PAN_ARCH >= 10;
+      .KHR_8bit_storage = true,
+      .KHR_16bit_storage = true,
+      bool has_vk1_1 = true;
+      bool has_vk1_2 = true;
+       *ext = (struct vk_device_extension_table){
@@ -0,0 +1,328 @@
+--- a/src/panfrost/vulkan/panvk_shader.h	2026-04-29 22:19:00.000000000 +0200
+++ b/src/panfrost/vulkan/panvk_shader.h	2026-05-20 18:52:53.312698258 +0200
+@@ -150,6 +150,10 @@
+    struct {
+ #if PAN_ARCH < 9
+       int32_t raw_vertex_offset;
+      uint32_t num_vertices;       /* iter13: XFB needs per-draw vertex count */
+      /* aligned_u64 attribute below inserts the 4-byte alignment gap
+       * after num_vertices automatically — no explicit pad needed. */
+      aligned_u64 xfb_address[4];  /* iter13: 4 transform feedback buffer base addresses */
+ #endif
+       int32_t first_vertex;
+       int32_t base_instance;
+--- a/src/panfrost/vulkan/panvk_vX_physical_device.c	2026-05-20 19:09:29.711145446 +0200
+++ b/src/panfrost/vulkan/panvk_vX_physical_device.c	2026-05-20 18:52:54.832720445 +0200
+@@ -169,6 +169,7 @@
+       .EXT_provoking_vertex = true,
+       .EXT_queue_family_foreign = true,
+       .EXT_robustness2 = true,
+      .EXT_transform_feedback = PAN_ARCH < 9,   /* iter13: JM-class only for now */
+       .EXT_sampler_filter_minmax = PAN_ARCH >= 10,
+       .EXT_scalar_block_layout = true,
+       .EXT_separate_stencil_usage = true,
+@@ -495,6 +496,10 @@
+       .robustImageAccess2 = false,
+       .nullDescriptor = true,
+ 
+      /* VK_EXT_transform_feedback (iter13) */
+      .transformFeedback = PAN_ARCH < 9,
+      .geometryStreams = false,
+
+       /* VK_KHR_shader_clock */
+       .shaderSubgroupClock = device->kmod.dev->props.gpu_can_query_timestamp,
+       .shaderDeviceClock = device->kmod.dev->props.timestamp_device_coherent,
+@@ -1020,6 +1025,18 @@
+       .robustStorageBufferAccessSizeAlignment = 1,
+       .robustUniformBufferAccessSizeAlignment = 1,
+ 
+      /* VK_EXT_transform_feedback (iter13) */
+      .maxTransformFeedbackStreams = 1,
+      .maxTransformFeedbackBuffers = 4,
+      .maxTransformFeedbackBufferSize = UINT32_MAX,
+      .maxTransformFeedbackStreamDataSize = 512,
+      .maxTransformFeedbackBufferDataSize = 512,
+      .maxTransformFeedbackBufferDataStride = 2048,
+      .transformFeedbackQueries = false,
+      .transformFeedbackStreamsLinesTriangles = false,
+      .transformFeedbackRasterizationStreamSelect = false,
+      .transformFeedbackDraw = false,
+
+       /* VK_EXT_shader_object */
+       /* We do not currently support VK_EXT_shader_object but this is used
+        * internally by vk_shader
+--- a/src/panfrost/vulkan/panvk_vX_shader.c	2026-04-29 22:19:00.000000000 +0200
+++ b/src/panfrost/vulkan/panvk_vX_shader.c	2026-05-20 18:52:56.556745611 +0200
+@@ -21,6 +21,7 @@
+ #include "panvk_physical_device.h"
+ #include "panvk_sampler.h"
+ #include "panvk_shader.h"
+#include "pan_nir.h"   /* iter13: pan_nir_lower_xfb */
+ 
+ #include "spirv/nir_spirv.h"
+ #include "util/memstream.h"
+@@ -100,6 +101,20 @@
+    case nir_intrinsic_load_raw_vertex_offset_pan:
+       val = load_sysval(b, graphics, bit_size, vs.raw_vertex_offset);
+       break;
+   case nir_intrinsic_load_num_vertices:    /* iter13: XFB index calc */
+      val = load_sysval(b, graphics, bit_size, vs.num_vertices);
+      break;
+   case nir_intrinsic_load_xfb_address: {   /* iter13: XFB buffer N base address */
+      unsigned idx = nir_intrinsic_base(intr);
+      switch (idx) {
+      case 0: val = load_sysval(b, graphics, bit_size, vs.xfb_address[0]); break;
+      case 1: val = load_sysval(b, graphics, bit_size, vs.xfb_address[1]); break;
+      case 2: val = load_sysval(b, graphics, bit_size, vs.xfb_address[2]); break;
+      case 3: val = load_sysval(b, graphics, bit_size, vs.xfb_address[3]); break;
+      default: return false;
+      }
+      break;
+   }
+    case nir_intrinsic_load_layer_id:
+       assert(b->shader->info.stage == MESA_SHADER_FRAGMENT);
+       val = load_sysval(b, graphics, bit_size, layer_id);
+@@ -457,6 +472,7 @@
+             core_max_id);
+ 
+    pan_preprocess_nir(nir, pdev->kmod.dev->props.gpu_id);
+
+ }
+ 
+ static void
+@@ -870,6 +886,18 @@
+             nir_var_shader_in | nir_var_shader_out, UINT32_MAX);
+    NIR_PASS(_, nir, nir_lower_io, nir_var_shader_in | nir_var_shader_out,
+             glsl_type_size, nir_lower_io_use_interpolated_input_intrinsics);
+
+#if PAN_ARCH < 9
+   /* iter13: VK_EXT_transform_feedback — runs AFTER nir_lower_io so that
+    * shader outputs are now store_output intrinsics that pan_nir_lower_xfb
+    * can rewrite to nir_store_global+nir_load_xfb_address. */
+   if (nir->info.stage == MESA_SHADER_VERTEX &&
+       nir->info.has_transform_feedback_varyings) {
+      NIR_PASS(_, nir, nir_opt_constant_folding);
+      NIR_PASS(_, nir, nir_io_add_intrinsic_xfb_info);
+      NIR_PASS(_, nir, pan_nir_lower_xfb);
+   }
+#endif
+ }
+ 
+ static VkResult
+@@ -1288,6 +1316,9 @@
+       .view_mask = (state && state->rp) ? state->rp->view_mask : 0,
+       .robust2_modes = robust2_modes,
+       .robust_descriptors = dev->vk.enabled_features.nullDescriptor,
+      /* iter13: XFB shaders must disable IDVS (matches Panfrost-Gallium). */
+      .no_idvs = (info->stage == MESA_SHADER_VERTEX) &&
+                 info->nir->info.has_transform_feedback_varyings,
+    };
+ 
+    switch (info->stage) {
+--- a/src/panfrost/vulkan/panvk_cmd_draw.h	2026-04-29 22:19:00.000000000 +0200
+++ b/src/panfrost/vulkan/panvk_cmd_draw.h	2026-05-20 18:52:57.748763011 +0200
+@@ -135,6 +135,19 @@
+    struct panvk_graphics_sysvals sysvals;
+ 
+ #if PAN_ARCH < 9
+   /* iter13: VK_EXT_transform_feedback state (JM-class only for now). */
+   struct {
+      bool active;
+      uint32_t buffer_count;
+      struct {
+         uint64_t addr;
+         uint64_t offset;
+         uint64_t size;
+      } buffers[4];
+   } xfb;
+#endif
+
+#if PAN_ARCH < 9
+    struct panvk_shader_link link;
+ #endif
+ 
+--- a/src/panfrost/vulkan/panvk_vX_cmd_draw.c	2026-04-29 22:19:00.000000000 +0200
+++ b/src/panfrost/vulkan/panvk_vX_cmd_draw.c	2026-05-20 19:10:23.031919662 +0200
+@@ -10,6 +10,7 @@
+ #include "panvk_entrypoints.h"
+ 
+ #include "pan_desc.h"
+#include "pan_compiler.h"   /* PAN_SHADER_OOB_ADDRESS */
+ #include "pan_util.h"
+ 
+ static void
+@@ -722,6 +723,35 @@
+    set_gfx_sysval(cmdbuf, dirty_sysvals, vs.raw_vertex_offset,
+                   info->vertex.raw_offset);
+    set_gfx_sysval(cmdbuf, dirty_sysvals, layer_id, info->layer_id);
+
+   /* iter13: VK_EXT_transform_feedback sysvals — always set (per draw),
+    * reflect bound XFB state. set_gfx_sysval is a no-op if value unchanged. */
+   set_gfx_sysval(cmdbuf, dirty_sysvals, vs.num_vertices, info->vertex.count);
+   {
+      const struct panvk_cmd_graphics_state *_gfx = &cmdbuf->state.gfx;
+      /* iter13: default each XFB buffer address to PAN_SHADER_OOB_ADDRESS
+       * (= 1<<63). This is the Panfrost-Gallium memory-sink idiom — the
+       * Bifrost MMU silently discards stores to this address, so a pipeline
+       * with XFB outputs used in a non-XFB draw (or in an XFB draw with
+       * fewer bound buffers than the shader declares) is safe instead of
+       * faulting. See gallium/drivers/panfrost/pan_cmdstream.c PAN_SYSVAL_XFB. */
+      uint64_t _xa0 = PAN_SHADER_OOB_ADDRESS, _xa1 = PAN_SHADER_OOB_ADDRESS,
+               _xa2 = PAN_SHADER_OOB_ADDRESS, _xa3 = PAN_SHADER_OOB_ADDRESS;
+      if (_gfx->xfb.active) {
+         if (_gfx->xfb.buffer_count > 0 && _gfx->xfb.buffers[0].addr)
+            _xa0 = _gfx->xfb.buffers[0].addr + _gfx->xfb.buffers[0].offset;
+         if (_gfx->xfb.buffer_count > 1 && _gfx->xfb.buffers[1].addr)
+            _xa1 = _gfx->xfb.buffers[1].addr + _gfx->xfb.buffers[1].offset;
+         if (_gfx->xfb.buffer_count > 2 && _gfx->xfb.buffers[2].addr)
+            _xa2 = _gfx->xfb.buffers[2].addr + _gfx->xfb.buffers[2].offset;
+         if (_gfx->xfb.buffer_count > 3 && _gfx->xfb.buffers[3].addr)
+            _xa3 = _gfx->xfb.buffers[3].addr + _gfx->xfb.buffers[3].offset;
+      }
+      set_gfx_sysval(cmdbuf, dirty_sysvals, vs.xfb_address[0], _xa0);
+      set_gfx_sysval(cmdbuf, dirty_sysvals, vs.xfb_address[1], _xa1);
+      set_gfx_sysval(cmdbuf, dirty_sysvals, vs.xfb_address[2], _xa2);
+      set_gfx_sysval(cmdbuf, dirty_sysvals, vs.xfb_address[3], _xa3);
+   }
+ #endif
+ 
+    if (dyn_gfx_state_dirty(cmdbuf, CB_BLEND_CONSTANTS)) {
+--- a/src/panfrost/vulkan/meson.build	2026-04-29 22:19:00.000000000 +0200
+++ b/src/panfrost/vulkan/meson.build	2026-05-20 18:53:04.484861338 +0200
+@@ -73,6 +73,7 @@
+ jm_inc_dir = ['jm']
+ jm_files = [
+   'jm/panvk_vX_bind_queue.c',
+  'jm/panvk_vX_cmd_xfb.c',   # iter13
+   'jm/panvk_vX_cmd_buffer.c',
+   'jm/panvk_vX_cmd_dispatch.c',
+   'jm/panvk_vX_cmd_draw.c',
+--- a/src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c	2026-04-29 22:19:00.000000000 +0200
+++ b/src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c	2026-05-20 19:10:26.163965149 +0200
+@@ -473,5 +473,12 @@
+ 
+    vk_command_buffer_begin(&cmdbuf->vk, pBeginInfo);
+ 
+#if PAN_ARCH < 9
+   /* iter13: clear XFB state on Begin so a reused command buffer does not
+    * inherit stale xfb.buffer_count / xfb.active / xfb.buffers[] from a
+    * prior recording. */
+   memset(&cmdbuf->state.gfx.xfb, 0, sizeof(cmdbuf->state.gfx.xfb));
+#endif
+
+    return VK_SUCCESS;
+ }
+--- a/src/panfrost/vulkan/jm/panvk_vX_cmd_xfb.c	2026-05-18 12:50:53.067999996 +0200
+++ b/src/panfrost/vulkan/jm/panvk_vX_cmd_xfb.c	2026-05-20 19:10:27.175979847 +0200
+@@ -0,0 +1,111 @@
+/*
+ * Copyright © 2026 mfritsche / claude-noether
+ * SPDX-License-Identifier: MIT
+ *
+ * iter13: VK_EXT_transform_feedback command handlers for the JM
+ * architecture path (Bifrost v6/v7 + Valhall-JM v9).
+ *
+ * The runtime contract:
+ *   - vkCmdBindTransformFeedbackBuffersEXT: stash (gpu_addr, offset, size)
+ *     for each slot into cmdbuf->state.gfx.xfb.buffers[].
+ *   - vkCmdBeginTransformFeedbackEXT: set cmdbuf->state.gfx.xfb.active = true.
+ *     Mark sysvals dirty so the next draw re-emits vs.xfb_address[].
+ *   - vkCmdEndTransformFeedbackEXT: set active = false.
+ *
+ * Counter buffers (firstCounterBuffer/counterBufferCount/pCounterBuffers/
+ * pCounterBufferOffsets) are accepted by API but ignored — v1 doesn't
+ * support pause/resume. transformFeedbackDraw is advertised as false.
+ *
+ * Per-draw integration: jm/panvk_vX_cmd_draw.c reads cmdbuf->state.gfx.xfb
+ * and populates vs.xfb_address[i] for shader use. The pan_nir_lower_xfb
+ * pass in panvk_vX_shader.c emits nir_load_xfb_address(i) which lowers
+ * (via panvk_vX_shader.c sysval handler) to a load from the per-draw
+ * sysval push area.
+ */
+
+#include "vk_log.h"
+#include "util/log.h"
+
+#include "panvk_cmd_buffer.h"
+#include "panvk_cmd_draw.h"
+#include "panvk_buffer.h"
+#include "panvk_entrypoints.h"
+
+VKAPI_ATTR void VKAPI_CALL
+panvk_per_arch(CmdBindTransformFeedbackBuffersEXT)(
+   VkCommandBuffer commandBuffer,
+   uint32_t firstBinding,
+   uint32_t bindingCount,
+   const VkBuffer *pBuffers,
+   const VkDeviceSize *pOffsets,
+   const VkDeviceSize *pSizes)
+{
+   VK_FROM_HANDLE(panvk_cmd_buffer, cmdbuf, commandBuffer);
+   struct panvk_cmd_graphics_state *gfx = &cmdbuf->state.gfx;
+
+   for (uint32_t i = 0; i < bindingCount; i++) {
+      uint32_t slot = firstBinding + i;
+      if (slot >= 4)
+         continue;
+
+      VK_FROM_HANDLE(panvk_buffer, buf, pBuffers[i]);
+      gfx->xfb.buffers[slot].addr = panvk_buffer_gpu_ptr(buf, 0);
+      gfx->xfb.buffers[slot].offset = pOffsets[i];
+      gfx->xfb.buffers[slot].size =
+         (pSizes != NULL && pSizes[i] != VK_WHOLE_SIZE)
+            ? pSizes[i]
+            : (buf->vk.size - pOffsets[i]);
+   }
+
+   if (firstBinding + bindingCount > gfx->xfb.buffer_count)
+      gfx->xfb.buffer_count = firstBinding + bindingCount;
+}
+
+VKAPI_ATTR void VKAPI_CALL
+panvk_per_arch(CmdBeginTransformFeedbackEXT)(
+   VkCommandBuffer commandBuffer,
+   uint32_t firstCounterBuffer,
+   uint32_t counterBufferCount,
+   const VkBuffer *pCounterBuffers,
+   const VkDeviceSize *pCounterBufferOffsets)
+{
+   VK_FROM_HANDLE(panvk_cmd_buffer, cmdbuf, commandBuffer);
+   struct panvk_cmd_graphics_state *gfx = &cmdbuf->state.gfx;
+
+   /* Counter buffers ignored in v1 — see VkPhysicalDeviceTransformFeedback
+    * PropertiesEXT.transformFeedbackDraw = false in panvk_vX_physical_device.c.
+    * App is spec-compliant if it does not pass counter buffers (which our
+    * features advertisement allows), but warn loudly if it does so we do not
+    * silently produce wrong capture state. */
+   (void)firstCounterBuffer;
+   (void)pCounterBufferOffsets;
+   if (counterBufferCount > 0 && pCounterBuffers != NULL) {
+      mesa_logw("panvk: CmdBeginTransformFeedbackEXT: counter buffers not "
+                "implemented (transformFeedbackDraw=false); XFB resume will "
+                "restart at buffer offset 0");
+   }
+
+   gfx->xfb.active = true;
+   /* Per-draw set_gfx_sysval picks up the change automatically — no
+    * explicit dirty marking required (set_gfx_sysval uses memcmp +
+    * BITSET to detect state diffs and re-emit sysvals). */
+}
+
+VKAPI_ATTR void VKAPI_CALL
+panvk_per_arch(CmdEndTransformFeedbackEXT)(
+   VkCommandBuffer commandBuffer,
+   uint32_t firstCounterBuffer,
+   uint32_t counterBufferCount,
+   const VkBuffer *pCounterBuffers,
+   const VkDeviceSize *pCounterBufferOffsets)
+{
+   VK_FROM_HANDLE(panvk_cmd_buffer, cmdbuf, commandBuffer);
+   struct panvk_cmd_graphics_state *gfx = &cmdbuf->state.gfx;
+
+   (void)firstCounterBuffer;
+   (void)counterBufferCount;
+   (void)pCounterBuffers;
+   (void)pCounterBufferOffsets;
+
+   gfx->xfb.active = false;
+}
@@ -0,0 +1,169 @@
+# Maintainer: Markus Fritsche <fritsche.markus@gmail.com>
+#
+# mesa-panvk-bifrost — patched Mesa libvulkan_panfrost.so that exposes
+# Bifrost-gen Mali (Mali-G31/G52/G72/G76, PAN_ARCH 6/7) to Chromium-family
+# browsers' Vulkan compositor.
+#
+# Campaign: ~/src/panvk-bifrost/ — iter9 close (technical milestone
+# 2026-05-20, operator-confirmed Brave window). Goal close requires
+# this package built + published + installable per the
+# feedback_package_done_means_installable.md 3-point check.
+#
+# What it does:
+#   - Builds Mesa 26.0.6 (matching ohm's stock mesa pkg) with two
+#     patches against src/panfrost/vulkan/panvk_vX_physical_device.c:
+#     (1) expose VK_KHR/EXT_robustness2 + nullDescriptor on PAN_ARCH 6/7
+#     (2) set has_vk1_1/has_vk1_2 to true on Bifrost
+#   - Installs the patched libvulkan_panfrost.so to /usr/lib/panvk-bifrost/
+#     (NOT /usr/lib — co-installs alongside stock mesa).
+#   - Registers a custom ICD JSON at a non-default path so the system
+#     Vulkan loader only picks up our driver when VK_ICD_FILENAMES is set.
+#   - Ships /usr/bin/brave-vulkan launcher that wires up env vars + flags.
+#
+# Co-existence: stock /usr/lib/libvulkan_panfrost.so is untouched. Stock
+# /usr/share/vulkan/icd.d/panfrost_icd.json is untouched. Users opt in
+# via brave-vulkan (or by setting VK_ICD_FILENAMES manually).
+#
+# Build target: arch-aarch64 runner via marfrit-packages Gitea Actions.
+# Mesa build is slow (~30-60min on Cortex-A55). Build deps installed
+# inside the runner via pacman -S in the workflow.
+
+pkgname=mesa-panvk-bifrost
+_mesaver=26.0.6
+pkgver=26.0.6.r3
+pkgrel=1
+pkgdesc="Patched Mesa libvulkan_panfrost.so exposing Bifrost-gen Mali to Vulkan apps (panvk-bifrost campaign)"
+arch=('aarch64')
+url="https://github.com/marfrit/panvk-bifrost"
+license=('MIT')
+
+# We co-install at /usr/lib/panvk-bifrost/ so no conflicts with stock mesa.
+# We DO provide a script that requires brave to be installed.
+depends=(
+    'mesa'              # for shared mesa runtime libs (libgallium-mesa etc.)
+    'libdrm'
+    'wayland'
+    'libxcb'
+    'libx11'
+    'libxshmfence'
+    'zlib'
+    'zstd'
+    'libdisplay-info'
+    'expat'
+    'systemd-libs'      # libudev
+    'spirv-tools'
+)
+optdepends=(
+    'brave-bin: for the brave-vulkan launcher script'
+)
+makedepends=(
+    'meson'
+    'ninja'
+    'pkgconf'
+    'bison'
+    'flex'
+    'python'
+    'python-yaml'
+    'python-mako'
+    'glslang'
+    'spirv-tools'
+    'llvm'
+    'clang'
+    'libclc'
+    'spirv-llvm-translator'
+    'vulkan-headers'
+    'wayland-protocols'
+)
+
+source=(
+    "https://archive.mesa3d.org/mesa-${_mesaver}.tar.xz"
+    "0001-panvk-expose-robustness2-nullDescriptor-bifrost.patch"
+    "0002-panvk-expose-vulkan-1.1-1.2-on-bifrost.patch"
+    "0003-panvk-bifrost-vk-ext-transform-feedback.patch"
+    "brave-vulkan"
+    "icd.json"
+)
+sha256sums=(
+    'SKIP'  # TODO: pin once we know the upstream tarball is stable. archive.mesa3d.org tarballs are stable, so we can hash-pin in iter10.
+    'SKIP'
+    'SKIP'
+    'SKIP'
+    'SKIP'
+    'SKIP'
+)
+
+prepare() {
+    cd "mesa-${_mesaver}"
+    # iter8 patch: robustness2 + nullDescriptor exposure on Bifrost.
+    # Three hunks in panvk_vX_physical_device.c. Apply via sed since
+    # the upstream context drifts between Mesa releases and unified-diff
+    # patching is brittle (we hit hunk-rejects during manual application).
+    sed -i 's|\.KHR_robustness2 = PAN_ARCH >= 10,|.KHR_robustness2 = true,|' src/panfrost/vulkan/panvk_vX_physical_device.c
+    sed -i 's|\.EXT_robustness2 = PAN_ARCH >= 10,|.EXT_robustness2 = true,|' src/panfrost/vulkan/panvk_vX_physical_device.c
+    sed -i 's|\.nullDescriptor = PAN_ARCH >= 10,|.nullDescriptor = true,|' src/panfrost/vulkan/panvk_vX_physical_device.c
+    # iter9 patch: bump api version to 1.1/1.2 for Bifrost. NOTE: this only
+    # affects extension exposure flags, NOT the reported apiVersion (which
+    # is set by get_api_version() further down and gated separately).
+    # The brave-vulkan launcher sets MESA_VK_VERSION_OVERRIDE=1.2 at runtime
+    # to deal with the latter — no source change needed for that path.
+    sed -i 's|bool has_vk1_1 = PAN_ARCH >= 10;|bool has_vk1_1 = true;|' src/panfrost/vulkan/panvk_vX_physical_device.c
+    sed -i 's|bool has_vk1_2 = PAN_ARCH >= 10;|bool has_vk1_2 = true;|' src/panfrost/vulkan/panvk_vX_physical_device.c
+
+    # iter13: VK_EXT_transform_feedback implementation for Bifrost (PAN_ARCH<9).
+    # Applied as a real unified-diff patch — the change is too large for sed.
+    # Phase-doc context: ~/src/panvk-bifrost/phase{4,5,6}_iter13_close.md.
+    # Unlocks ANGLE-Vulkan → GLES3 → WebGL2 / WebGPU on Brave (chrome://gpu
+    # reports "Hardware accelerated" across the board for the affected paths).
+    patch -p1 < "${srcdir}/0003-panvk-bifrost-vk-ext-transform-feedback.patch"
+
+    # Sanity-check the patches landed.
+    grep -q "KHR_robustness2 = true," src/panfrost/vulkan/panvk_vX_physical_device.c
+    grep -q "EXT_robustness2 = true," src/panfrost/vulkan/panvk_vX_physical_device.c
+    grep -q "nullDescriptor = true," src/panfrost/vulkan/panvk_vX_physical_device.c
+    grep -q "has_vk1_1 = true;" src/panfrost/vulkan/panvk_vX_physical_device.c
+    grep -q "has_vk1_2 = true;" src/panfrost/vulkan/panvk_vX_physical_device.c
+    # iter13 sanity:
+    grep -q "EXT_transform_feedback = PAN_ARCH < 9," src/panfrost/vulkan/panvk_vX_physical_device.c
+    grep -q "pan_nir_lower_xfb" src/panfrost/vulkan/panvk_vX_shader.c
+    test -f src/panfrost/vulkan/jm/panvk_vX_cmd_xfb.c
+}
+
+build() {
+    cd "mesa-${_mesaver}"
+    # Minimal Mesa build — only the panvk Vulkan driver. No GLES/GLX/EGL/
+    # gallium drivers — keeps the build narrower and avoids pulling in
+    # the entire Mesa runtime in this package's dep graph.
+    meson setup build/ \
+        --prefix=/usr \
+        --libdir=lib \
+        --buildtype=release \
+        -Dvulkan-drivers=panfrost \
+        -Dgallium-drivers= \
+        -Dplatforms=wayland,x11 \
+        -Dglx=disabled \
+        -Degl=disabled \
+        -Dgles1=disabled \
+        -Dgles2=disabled \
+        -Dvulkan-layers= \
+        -Dtools= \
+        -Dgallium-rusticl=false \
+        -Dmicrosoft-clc=disabled
+    meson compile -C build
+}
+
+package() {
+    cd "${srcdir}/mesa-${_mesaver}"
+
+    # Patched lib — co-install path, NOT /usr/lib (to avoid clashing
+    # with stock mesa's libvulkan_panfrost.so).
+    install -Dm755 build/src/panfrost/vulkan/libvulkan_panfrost.so \
+        "$pkgdir/usr/lib/panvk-bifrost/libvulkan_panfrost.so"
+
+    # Custom ICD JSON. NOT under /usr/share/vulkan/icd.d/ (the default
+    # loader search path) — the user has to opt in via VK_ICD_FILENAMES.
+    install -Dm644 "$srcdir/icd.json" \
+        "$pkgdir/usr/lib/panvk-bifrost/icd.json"
+
+    # The brave-vulkan launcher wires up env + flags.
+    install -Dm755 "$srcdir/brave-vulkan" "$pkgdir/usr/bin/brave-vulkan"
+}
@@ -0,0 +1,83 @@
+# mesa-panvk-bifrost
+
+Patched Mesa `libvulkan_panfrost.so` exposing Bifrost-gen Mali GPUs
+(Mali-G31/G52/G72/G76, PAN_ARCH 6/7) to Chromium-family browsers'
+Vulkan compositor.
+
+Result of the **panvk-bifrost** campaign ([`~/src/panvk-bifrost/`](../../../panvk-bifrost/)),
+iter9 close 2026-05-20 (technical milestone — operator-confirmed Brave
+window) followed by this package as the actual delivery.
+
+## What it solves
+
+Stock Chromium / Brave on Bifrost SBCs (PineTab2, etc.) currently dies
+at GL bindings init:
+
+```
+ERROR: ui/gl/gl_context_egl.cc:120  GLES3 is unsupported and ES version fallback is disabled
+ERROR: ui/gl/init/gl_factory.cc:111  Requested GL implementation not found
+ERROR: components/viz/service/main/viz_main_impl.cc:189  Exiting GPU process due to errors during initialization
+```
+
+This package makes Brave's **Vulkan compositor path** work on Bifrost,
+side-stepping the failing GL stack. Browser chrome and standard page
+rendering work.
+
+## Known limitations (not addressed)
+
+- **WebGL / WebGL2** in-page: blocked. ANGLE needs `VK_EXT_transform_feedback`
+  to expose GLES3 contexts; PanVk-Bifrost doesn't currently support that.
+  Sites using WebGL will degrade or refuse.
+- **VAAPI hardware video decode**: unrelated to this package — see the
+  `libva-v4l2-request-fourier` package for that path.
+
+## Install
+
+```sh
+# Ensure [marfrit] is in /etc/pacman.conf, then:
+sudo pacman -Sy mesa-panvk-bifrost
+```
+
+## Use
+
+```sh
+brave-vulkan                                    # launches Brave with Vulkan
+brave-vulkan https://www.example.com
+brave-vulkan --your-flags-here                  # extra args passed through
+```
+
+The launcher sets:
+
+- `VK_ICD_FILENAMES=/usr/lib/panvk-bifrost/icd.json` (the patched driver)
+- `PAN_I_WANT_A_BROKEN_VULKAN_DRIVER=1` (Mesa upstream gate)
+- `MESA_VK_VERSION_OVERRIDE=1.2` (apiVersion bump for ANGLE)
+- Brave flags: `--use-gl=disabled --enable-features=Vulkan --use-vulkan=native --ozone-platform=x11 --no-sandbox --disable-gpu-sandbox --ignore-gpu-blocklist`
+
+## What's in the package
+
+- `/usr/lib/panvk-bifrost/libvulkan_panfrost.so` — patched Mesa Vulkan driver (Mesa 26.0.6 + 2 sed-applied patches)
+- `/usr/lib/panvk-bifrost/icd.json` — Vulkan ICD JSON pointing at the patched .so (NOT auto-loaded; only via `VK_ICD_FILENAMES`)
+- `/usr/bin/brave-vulkan` — launcher script
+
+System Mesa is untouched. The stock `/usr/lib/libvulkan_panfrost.so` and
+`/usr/share/vulkan/icd.d/panfrost_icd.json` continue to work for any
+other Vulkan app.
+
+## Co-existence
+
+Both stock Mesa and this package can be installed. Stock Vulkan apps
+(`vulkaninfo`, `vkcube`, etc.) use the stock driver by default. Only
+apps started via `brave-vulkan` (or with `VK_ICD_FILENAMES` manually
+set to our path) use the patched driver.
+
+## Campaign close criterion
+
+Per [`feedback_package_done_means_installable`](file:///home/mfritsche/.claude/projects/-home-mfritsche-src/memory/feedback_package_done_means_installable.md)
+three-point check:
+
+1. PR merged to `marfrit-packages`
+2. CI green AND `packages.reauktion.de/arch/aarch64/mesa-panvk-bifrost-*.pkg.tar.zst` exists
+3. `pacman -Ss mesa-panvk-bifrost` on a fresh consumer host (e.g. ohm
+   after `pacman -Syu` from clean state) returns the package + brave-vulkan launches
+
+When all three pass, panvk-bifrost iter9 closes.
@@ -0,0 +1,61 @@
+#!/bin/bash
+# brave-vulkan — launch Brave with the PanVk-Bifrost Vulkan compositor on
+# Bifrost SBCs (PineTab2 / Mali-G52 r1 MC1 and similar).
+#
+# Side-steps the GL stack failures stock Brave hits on Bifrost
+# (the README "Consumer-side benefit" path of the panvk-bifrost campaign).
+#
+# Provided by the mesa-panvk-bifrost package. See:
+#   /usr/share/doc/mesa-panvk-bifrost/README
+#   ~/src/panvk-bifrost/phase8_iteration9_close.md (campaign close)
+#
+# Usage: brave-vulkan [brave args...]
+# Equivalent to: brave [VULKAN_FLAGS] [your args]
+
+set -e
+
+# Patched Vulkan driver (from this package) — must point at the custom path
+# so we don't clash with the stock /usr/share/vulkan/icd.d/panfrost_icd.json
+export VK_ICD_FILENAMES=/usr/lib/panvk-bifrost/icd.json
+
+# PanVk's "I know it's not conformant" gate — the patched driver still
+# refuses to enumerate Bifrost without this env var (Mesa upstream choice,
+# kept for compatibility).
+export PAN_I_WANT_A_BROKEN_VULKAN_DRIVER=1
+
+# Override apiVersion to 1.2 — ANGLE (Chromium's GL stack) requires
+# device.apiVersion >= 1.1. The patched libvulkan_panfrost.so still has
+# a PAN_ARCH>=10 gate inside get_api_version(); easier to override at
+# runtime via this Mesa env var than to add a third patch.
+export MESA_VK_VERSION_OVERRIDE=1.2
+
+# Find the live Plasma session's Xauthority. On a fresh boot the suffix
+# is randomized; pgrep the Xwayland args to find the current one.
+if [ -z "${XAUTHORITY:-}" ]; then
+    XAUTHF=$(pgrep -fa Xwayland 2>/dev/null | grep -oE "/run/user/$(id -u)/xauth_[A-Za-z0-9]+" | head -1)
+    if [ -n "$XAUTHF" ]; then
+        export XAUTHORITY="$XAUTHF"
+    fi
+fi
+
+# Standard session env if not already set
+: "${XDG_RUNTIME_DIR:=/run/user/$(id -u)}"
+export XDG_RUNTIME_DIR
+
+# Default to the active Plasma Wayland session if WAYLAND_DISPLAY unset
+: "${WAYLAND_DISPLAY:=wayland-0}"
+export WAYLAND_DISPLAY
+
+# Default to the XWayland :1 unless DISPLAY is set
+: "${DISPLAY:=:1}"
+export DISPLAY
+
+exec brave \
+    --use-gl=disabled \
+    --enable-features=Vulkan \
+    --use-vulkan=native \
+    --ozone-platform=x11 \
+    --no-sandbox \
+    --disable-gpu-sandbox \
+    --ignore-gpu-blocklist \
+    "$@"
@@ -0,0 +1,7 @@
+{
+    "ICD": {
+        "api_version": "1.4.335",
+        "library_path": "/usr/lib/panvk-bifrost/libvulkan_panfrost.so"
+    },
+    "file_format_version": "1.0.1"
+}
@@ -28,7 +28,7 @@ pkgname=(qt6-base-fourier
         qt6-xcb-private-headers-fourier)
 _pkgver=6.11.1
 pkgver=${_pkgver/-/}
-pkgrel=1
+pkgrel=2
 epoch=1
 arch=(aarch64 x86_64)
 url='https://www.qt.io'
@@ -188,7 +188,7 @@ package_qt6-xcb-private-headers-fourier() {
  conflicts=(qt6-xcb-private-headers)
  replaces=(qt6-xcb-private-headers)

-  depends=("qt6-base-fourier=$pkgver")
+  depends=("qt6-base-fourier=$epoch:$pkgver")
  optdepends=()
  groups=()

@@ -16,7 +16,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT

 cd "$work"
-curl -sSLfo his.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo his.tar.gz \
    "https://git.reauktion.de/marfrit/claude-his-agent/archive/v${PKGVER}.tar.gz"
 echo "$HIS_TARBALL_SHA256  his.tar.gz" | sha256sum -c
 tar xzf his.tar.gz
@@ -14,9 +14,9 @@
 # Sibling userspace package: ../daedalus-v4l2/build-deb.sh
 set -euo pipefail

-UPSTREAM_COMMIT=f55b2cdab8a8c0bc04e8c1bb1d0b6ca85e7d96d2
-PKGVER=0.1.0+r16+gf55b2cd
-PKGREL=1
+UPSTREAM_COMMIT=79256dc7ef41f83873ca9c23db20f5888858e65d
+PKGVER=0.1.0+r28+g79256dc
+PKGREL=1  # reset for new upstream pin (79256dc — H.264 B-frame reorder fix); still carries the #64 multi-kernel postinst fix
 MODULE_NAME=daedalus_v4l2

 HERE=$(dirname "$(readlink -f "$0")")
@@ -28,7 +28,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT

 cd "$work"
-curl -sSLfo daedalus-v4l2.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo daedalus-v4l2.tar.gz \
    "https://git.reauktion.de/reauktion/daedalus-v4l2/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf daedalus-v4l2.tar.gz
 SRCDIR=daedalus-v4l2
@@ -78,7 +78,6 @@ set -e

 NAME=${MODULE_NAME}
 VERSION=${PKGVER}
-KERNELVER=\$(uname -r)

 # Yellow + bold ANSI for the warning so it stands out in apt's
 # stream of "Setting up" lines.  Disable colour on non-TTY.
@@ -101,29 +100,56 @@ if [ "\$1" = "configure" ]; then

    dkms add "\$NAME/\$VERSION" 2>/dev/null || true

-    # Don't let autoinstall failure mask the actual problem behind '|| true'.
-    # Run it, capture the result, then verify post-condition.
-    autoinstall_rc=0
-    dkms autoinstall "\$NAME/\$VERSION" || autoinstall_rc=\$?
+    # Enumerate every kernel whose headers are actually present
+    # (/lib/modules/<kver>/build resolves to a directory).  We iterate
+    # all of them — not just \$(uname -r) — so that installing this
+    # package after a kernel update covers the newly-installed kernel
+    # too, and so that a later kernel-headers install for a previously
+    # uncovered version gets picked up on dpkg-reconfigure.  Without
+    # this, autoinstall (which targets only the running kernel) leaves
+    # /dev/daedalus-v4l2 absent after a kernel switch + reboot
+    # (marfrit/marfrit-packages#64).
+    kvers=''
+    for d in /lib/modules/*/build; do
+        [ -d "\$d" ] || continue
+        k=\$(basename "\$(dirname "\$d")")
+        kvers="\$kvers \$k"
+    done

-    # Verify the module actually built + installed for the running kernel.
-    status=\$(dkms status -m "\$NAME" -v "\$VERSION" -k "\$KERNELVER" 2>/dev/null || true)
-    if ! printf '%s\\n' "\$status" | grep -q -E 'installed|loaded'; then
+    if [ -z "\$kvers" ]; then
        warn ""
-        warn "DKMS build did NOT land for kernel \$KERNELVER."
-        warn "  dkms status -m \$NAME -v \$VERSION -k \$KERNELVER:"
-        warn "    \$(printf '%s' "\$status" | head -1)"
-        warn ""
-        warn "Most likely cause: kernel headers package is missing."
-        warn "  Raspberry Pi OS / Pi 5:  apt install linux-headers-rpi-2712"
-        warn "  Debian generic:          apt install linux-headers-\$KERNELVER"
-        warn ""
-        warn "After installing headers, finish the install with:"
+        warn "No kernels with headers found under /lib/modules/*/build."
+        warn "Install kernel headers (e.g. linux-headers-rpi-2712 on Pi OS)"
+        warn "then finish with:"
        warn "  sudo dkms autoinstall \$NAME/\$VERSION"
-        warn "  sudo modprobe daedalus_v4l2"
+        exit 0
+    fi
+
+    failed=''
+    for k in \$kvers; do
+        dkms autoinstall -k "\$k" "\$NAME/\$VERSION" >/dev/null 2>&1 || true
+        s=\$(dkms status -m "\$NAME" -v "\$VERSION" -k "\$k" 2>/dev/null || true)
+        if ! printf '%s\\n' "\$s" | grep -q -E 'installed|loaded'; then
+            failed="\$failed \$k"
+        fi
+    done
+
+    if [ -n "\$failed" ]; then
        warn ""
-        warn "Until then daedalus_v4l2 will NOT be loadable and the"
-        warn "userspace daedalus-v4l2 daemon will have nothing to talk to."
+        warn "DKMS build did NOT land for kernel(s):\$failed"
+        warn ""
+        warn "Most likely cause: kernel headers missing for those versions."
+        warn "  Raspberry Pi OS / Pi 5:  apt install linux-headers-rpi-2712"
+        warn "  Debian generic:          apt install linux-headers-<version>"
+        warn ""
+        warn "After installing headers, finish with:"
+        for k in \$failed; do
+            warn "  sudo dkms autoinstall -k \$k \$NAME/\$VERSION"
+        done
+        warn "  sudo modprobe daedalus_v4l2  (after booting that kernel)"
+        warn ""
+        warn "Until then daedalus_v4l2 will NOT be loadable on those kernels"
+        warn "and the userspace daedalus-v4l2 daemon will have nothing to talk to."
    fi
 fi

@@ -153,7 +179,7 @@ Section: kernel
 Priority: optional
 Architecture: all
 Depends: dkms (>= 2.1.0.0)
-Recommends: daedalus-v4l2, linux-headers-generic | linux-headers
+Recommends: daedalus-v4l2, linux-headers-rpi-2712 | linux-headers-rpi | linux-headers-generic | linux-headers
 Maintainer: Markus Fritsche <mfritsche@reauktion.de>
 Homepage: https://git.reauktion.de/reauktion/daedalus-v4l2
 Description: V4L2 stateless decoder shim kernel module (DKMS) — Pi 5 / CM5
@@ -1,3 +1,102 @@
+daedalus-v4l2-dkms (0.1.0+r28+g79256dc-1) bookworm trixie; urgency=medium
+
+  * Bump to 79256dc — H.264 B-frame display reorder fix (closes
+    daedalus-v4l2#6).  libavcodec's H.264 decoder reorders output to
+    display order before returning from avcodec_receive_frame; the
+    daemon was binding each REQ_DECODE's pixels to the cookie of the
+    bitstream that triggered the receive_frame call, not the cookie
+    of the bitstream that actually produced the picture.  For B-frame
+    sequences this paired cookie N's CAPTURE buffer with cookie N-2's
+    pixels and silently lost intermediate frames — visible as
+    "2 1 4 3 6 5" frame pairing in mpv / Firefox on Pi CM5.
+  * Wire-protocol bump (DAEDALUS_PROTO_VERSION 0 → 1): REQ_DECODE
+    gains __u64 src_pts; RESP_FRAME gains __u32 flags +
+    __u64 output_src_pts.  Kernel + daemon must install atomically
+    (this package + daedalus-v4l2 0.1.0+r28+g79256dc).
+  * Carries forward the #64 multi-kernel postinst fix from -2:
+    autoinstall for every /lib/modules/*/build that resolves to real
+    headers, not just $(uname -r).
+  * Closes #64.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Thu, 21 May 2026 12:00:00 +0000
+
+daedalus-v4l2-dkms (0.1.0+r24+gf0d4186-2) bookworm trixie; urgency=medium
+
+  * postinst: autoinstall for every installed kernel with headers, not
+    just the running one.  Previously `dkms autoinstall $NAME/$VERSION`
+    built only against `$(uname -r)`, so installing the package on
+    kernel A and then rebooting into a separately-installed kernel B
+    left /lib/modules/B/updates/dkms/ empty — /dev/daedalus-v4l2 absent,
+    daedalus daemon nothing to talk to, browser/VAAPI silently falling
+    back to software with no obvious diagnostic.  Now we enumerate every
+    /lib/modules/*/build that resolves to a real directory and run
+    `dkms autoinstall -k <kver>` for each, reporting per-kernel failure
+    only when headers are missing.  Closes #64.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Thu, 21 May 2026 09:30:00 +0000
+
+daedalus-v4l2-dkms (0.1.0+r24+gf0d4186-1) bookworm trixie; urgency=medium
+
+  * Bump to f0d4186 — per-ctx vb2 lock fix.  daedalus_queue_init now
+    uses ctx->vb_mutex instead of ctx->dev->m2m_lock for each
+    vb2_queue's lock, unblocking Firefox's multi-process VAAPI
+    clients (they were colliding on the device-wide mutex and one
+    would EBUSY-fail S_FMT while another was mid-streamon).
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 23:00:00 +0000
+
+daedalus-v4l2-dkms (0.1.0+r22+g462aa4b-1) bookworm trixie; urgency=medium
+
+  * Bump to 462aa4b — kernel device_run() now calls
+    v4l2_ctrl_request_setup() before reading the H.264 stateless
+    control values from the bound media_request, so the values
+    daedalus ships to the userspace daemon match what the V4L2
+    client (libva-v4l2-request-fourier) actually set.  Closes the
+    libva→kernel control-binding gap that was causing decoded
+    frames to come back as best-effort zero garbage from libavcodec.
+  * Wire-ABI lockstep with daedalus-v4l2 0.1.0+r22+g462aa4b.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 22:00:00 +0000
+
+daedalus-v4l2-dkms (0.1.0+r20+g3dd0eb0-1) bookworm trixie; urgency=medium
+
+  * Bump to 3dd0eb0 — DAEMON-PPS kernel-side changes.  device_run()
+    now reads the V4L2 H.264 stateless control values from the bound
+    media_request and ships them to the daemon inside REQ_DECODE
+    via the new struct daedalus_h264_meta block (gated on
+    DAEDALUS_REQ_FLAG_H264_META).  Required for H.264 decode to
+    work via the libva-v4l2-request -> daedalus daemon path; daemon
+    synthesises AnnexB SPS+PPS NAL units from the structs.
+  * Wire-ABI lockstep with daedalus-v4l2 0.1.0+r20+g3dd0eb0 — install
+    both packages together.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 21:00:00 +0000
+
+daedalus-v4l2-dkms (0.1.0+r18+g481279c-1) bookworm trixie; urgency=medium
+
+  * Bump to 481279c in lockstep with the userspace daedalus-v4l2
+    package (which ships the new systemd unit + modules-load.d
+    drop-in).  No kernel-module behaviour change in this commit —
+    bump is purely to keep DKMS pkgver and userspace pkgver aligned
+    so /etc/modules-load.d/daedalus-v4l2.conf has a module to load.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 16:00:00 +0000
+
+daedalus-v4l2-dkms (0.1.0+r17+gf0cd29a-1) bookworm trixie; urgency=medium
+
+  * Bump to f0cd29a — Linux 6.18 compatibility fix.  v4l2_fh_add /
+    v4l2_fh_del gained a `struct file *filp` second argument at
+    v6.18; module source now uses LINUX_VERSION_CODE conditional so
+    it builds against 6.12 (Pi 5 stock RPi-2712 kernel) AND 6.18+
+    (RPi-2712 / arm64).  Verified DKMS rebuild on higgs
+    (6.18.29+rpt-rpi-2712) succeeds + /dev/daedalus-v4l2 appears.
+  * Recommends widened so apt pulls the right kernel-headers
+    metapackage on RPi OS: linux-headers-rpi-2712 first, then
+    linux-headers-rpi, then linux-headers-generic, then
+    linux-headers.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Tue, 20 May 2026 10:30:00 +0000
+
 daedalus-v4l2-dkms (0.1.0+r16+gf55b2cd-1) bookworm trixie; urgency=medium

  * Initial Debian DKMS packaging for the daedalus_v4l2 kernel module.
@@ -10,7 +10,7 @@ Package: daedalus-v4l2-dkms
 Architecture: all
 Depends: ${misc:Depends}, dkms (>= 2.1.0.0)
 Recommends: daedalus-v4l2,
-            linux-headers-generic | linux-headers
+            linux-headers-rpi-2712 | linux-headers-rpi | linux-headers-generic | linux-headers
 Description: V4L2 stateless decoder shim kernel module (DKMS) — Pi 5 / CM5
 Out-of-tree V4L2 m2m kernel module for the daedalus-v4l2 stack on
 Raspberry Pi 5 / CM5. Registers /dev/videoNN (V4L2 stateless m2m
@@ -11,13 +11,16 @@
 # Upstream repo: https://git.reauktion.de/reauktion/daedalus-v4l2
 set -euo pipefail

-# Same pin as the Arch PKGBUILD.  f55b2cd = "Phase 8.13: byte-exact
-# end-to-end via libva (consumer target hit)" — first commit where the
-# full ffmpeg -hwaccel vaapi → libva → /dev/video0 → daemon path lands
-# a pixel-correct decoded frame back in ffmpeg.
-UPSTREAM_COMMIT=f55b2cdab8a8c0bc04e8c1bb1d0b6ca85e7d96d2
-PKGVER=0.1.0+r16+gf55b2cd
-PKGREL=1
+# Same pin as the Arch PKGBUILD.  79256dc = "kernel + daemon: H.264
+# B-frame display reorder fix (closes #6)" — adds the wire-protocol
+# src_pts / output_src_pts / RESP_FRAME flags split that lets H.264
+# streams with B-frames preserve display order through libva → kernel
+# → daemon.  PROTO_VERSION bumps 0 → 1; lock-step userspace + kernel
+# rebuild REQUIRED (daedalus-v4l2-dkms build-deb.sh pinned to the same
+# commit).
+UPSTREAM_COMMIT=79256dc7ef41f83873ca9c23db20f5888858e65d
+PKGVER=0.1.0+r28+g79256dc
+PKGREL=1  # reset for new upstream pin (79256dc — H.264 B-frame reorder fix)

 HERE=$(dirname "$(readlink -f "$0")")

@@ -28,7 +31,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT

 cd "$work"
-curl -sSLfo daedalus-v4l2.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo daedalus-v4l2.tar.gz \
    "https://git.reauktion.de/reauktion/daedalus-v4l2/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf daedalus-v4l2.tar.gz
 SRCDIR=daedalus-v4l2
@@ -50,7 +53,9 @@ mkdir -p "$ROOT/DEBIAN" \
         "$ROOT/usr/bin" \
         "$ROOT/usr/libexec/daedalus-v4l2" \
         "$ROOT/usr/include" \
-         "$ROOT/usr/share/doc/daedalus-v4l2"
+         "$ROOT/usr/share/doc/daedalus-v4l2" \
+         "$ROOT/lib/systemd/system" \
+         "$ROOT/usr/lib/modules-load.d"

 install -m 755 "$work/$SRCDIR/daemon/build/daedalus_v4l2_daemon" \
    "$ROOT/usr/bin/daedalus_v4l2_daemon"
@@ -65,6 +70,14 @@ install -m 755 "$work/$SRCDIR/tools/test_m2m_stream" \
 install -m 644 "$work/$SRCDIR/include/daedalus_v4l2_proto.h" \
    "$ROOT/usr/include/daedalus_v4l2_proto.h"

+# systemd unit + module autoload — without these the daemon never
+# starts and the libva/VAAPI consumer's REQ_DECODE has nobody on
+# the other end of /dev/daedalus-v4l2.
+install -m 644 "$work/$SRCDIR/packaging/systemd/daedalus-v4l2.service" \
+    "$ROOT/lib/systemd/system/daedalus-v4l2.service"
+install -m 644 "$work/$SRCDIR/packaging/systemd/daedalus-v4l2.modules-load" \
+    "$ROOT/usr/lib/modules-load.d/daedalus-v4l2.conf"
+
 install -m 644 "$work/$SRCDIR/README.md" \
    "$ROOT/usr/share/doc/daedalus-v4l2/README.md"
 for d in "$work/$SRCDIR/docs/"*.md; do
@@ -75,13 +88,78 @@ install -Dm644 "$HERE/debian/copyright" "$ROOT/usr/share/doc/daedalus-v4l2/copyr
 install -Dm644 "$HERE/debian/changelog" "$ROOT/usr/share/doc/daedalus-v4l2/changelog.Debian"
 gzip -9 -n "$ROOT/usr/share/doc/daedalus-v4l2/changelog.Debian"

+# DEBIAN/postinst — enable service + reload modules-load.d so the
+# kernel module loads now if daedalus-v4l2-dkms is also installed.
+# Does NOT auto-start the service — that requires /dev/daedalus-v4l2
+# to already exist (the ConditionPathExists= in the .service file)
+# which may not be true on the very first install before the user
+# reboots or manually modprobes.  Operator decides when to start.
+cat > "$ROOT/DEBIAN/postinst" <<'POSTINST'
+#!/bin/sh
+set -e
+
+if [ "$1" = "configure" ]; then
+    # Reload systemd so the new unit file is visible.
+    if command -v systemctl >/dev/null 2>&1; then
+        systemctl daemon-reload >/dev/null 2>&1 || true
+        systemctl enable daedalus-v4l2.service >/dev/null 2>&1 || true
+    fi
+
+    # Trigger /usr/lib/modules-load.d/daedalus-v4l2.conf without a
+    # reboot.  Harmless if the module is already loaded; logs to
+    # journal if it can't load (most common cause: dkms hasn't built
+    # the module yet for the running kernel — see daedalus-v4l2-dkms
+    # postinst for the loud-warning path).
+    if command -v systemd-modules-load >/dev/null 2>&1; then
+        systemd-modules-load >/dev/null 2>&1 || true
+    fi
+
+    # Auto-start if /dev/daedalus-v4l2 came up (i.e. module loaded
+    # successfully).  ConditionPathExists in the unit file means
+    # `systemctl start` is a no-op if the device isn't there yet —
+    # avoids spurious failures during apt install on a host where
+    # daedalus-v4l2-dkms hasn't built yet.
+    if [ -e /dev/daedalus-v4l2 ] && command -v systemctl >/dev/null 2>&1; then
+        systemctl start daedalus-v4l2.service >/dev/null 2>&1 || true
+    fi
+fi
+
+#DEBHELPER#
+POSTINST
+chmod 755 "$ROOT/DEBIAN/postinst"
+
+cat > "$ROOT/DEBIAN/prerm" <<'PRERM'
+#!/bin/sh
+set -e
+
+if [ "$1" = "remove" ] && command -v systemctl >/dev/null 2>&1; then
+    systemctl stop    daedalus-v4l2.service >/dev/null 2>&1 || true
+    systemctl disable daedalus-v4l2.service >/dev/null 2>&1 || true
+fi
+
+#DEBHELPER#
+PRERM
+chmod 755 "$ROOT/DEBIAN/prerm"
+
+cat > "$ROOT/DEBIAN/postrm" <<'POSTRM'
+#!/bin/sh
+set -e
+
+if command -v systemctl >/dev/null 2>&1; then
+    systemctl daemon-reload >/dev/null 2>&1 || true
+fi
+
+#DEBHELPER#
+POSTRM
+chmod 755 "$ROOT/DEBIAN/postrm"
+
 cat > "$ROOT/DEBIAN/control" <<EOF
 Package: daedalus-v4l2
 Version: ${PKGVER}-${PKGREL}
 Section: video
 Priority: optional
 Architecture: arm64
-Depends: ffmpeg (>= 7.1), libdrm2
+Depends: ffmpeg-v4l2-request-fourier (>= 2:8.1+rfourier), libdrm2
 Recommends: daedalus-v4l2-dkms
 Maintainer: Markus Fritsche <mfritsche@reauktion.de>
 Homepage: https://git.reauktion.de/reauktion/daedalus-v4l2
@@ -1,3 +1,104 @@
+daedalus-v4l2 (0.1.0+r28+g79256dc-1) bookworm trixie; urgency=medium
+
+  * Bump to 79256dc — H.264 B-frame display reorder fix (closes
+    daedalus-v4l2#6 + #4 menu controls).  Daemon side: the
+    avcodec_send_packet → receive_frame loop now stamps pkt->pts =
+    req->src_pts so libavcodec's display-ordered frame->pts identifies
+    which OUTPUT bitstream's pixels each drained frame belongs to.
+    chardev_client maintains a (src_pts → cookie) lookup table so the
+    daemon can ship pixels to the cookie of the *originating*
+    bitstream, not the cookie of whatever REQ triggered the
+    receive_frame call.  Multiple RESP_FRAME messages per REQ_DECODE
+    are now possible (one for the just-consumed src, one or more for
+    drained pixels).
+  * Wire-protocol bump (DAEDALUS_PROTO_VERSION 0 → 1): REQ_DECODE
+    gains __u64 src_pts; RESP_FRAME gains __u32 flags +
+    __u64 output_src_pts.  Daemon + kernel must install atomically
+    (this package + daedalus-v4l2-dkms 0.1.0+r28+g79256dc).
+  * Also subsumes 79256dc's predecessor 7ff2d89 — H.264 DECODE_MODE +
+    START_CODE menu-control registration that retires the
+    "Unable to set control(s) error_idx=2/2" warning libva-v4l2-
+    request emitted on every context init.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Thu, 21 May 2026 12:00:00 +0000
+
+daedalus-v4l2 (0.1.0+r24+gf0d4186-1) bookworm trixie; urgency=medium
+
+  * Bump to f0d4186 — kernel per-ctx vb2 lock fix.  daedalus_queue_init
+    was wiring src_vq->lock and dst_vq->lock to ctx->dev->m2m_lock (a
+    device-wide mutex), serialising every vb2 ioctl across all
+    concurrent clients of /dev/video0.  For Firefox (which spawns
+    separate content + RDD + GPU processes that each open the device
+    and run libva probe simultaneously), one libva session's
+    S_FMT(OUTPUT_MPLANE) hit EBUSY while another was mid-streamon —
+    Firefox VAAPI playback fell apart at startup.
+  * Fix gives each open() its own ctx->vb_mutex; vb2 ioctls run
+    independently per client.  Matches cedrus / rkvdec / hantro
+    pattern.
+  * Verified on higgs: Firefox YouTube playback engages VAAPI cleanly,
+    sustained ~230 fps decode at 640x368 through the daedalus daemon,
+    zero EBUSY in stderr or daemon journal.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 23:00:00 +0000
+
+daedalus-v4l2 (0.1.0+r22+g462aa4b-1) bookworm trixie; urgency=medium
+
+  * Bump to 462aa4b — kernel-side fix for control-binding gap that
+    closes the libva→daemon SPS/PPS pipeline.  Kernel device_run now
+    calls v4l2_ctrl_request_setup() before reading ctrl->p_cur, so
+    the daemon's daedalus_h264_meta block actually carries THIS
+    request's V4L2 stateless H.264 control values instead of stale
+    /default ones.  Pairs with libva-v4l2-request-fourier r382+gc1bb444
+    (Fix 3 + Fix 4 from issue libva-v4l2-request-fourier#8).
+  * After-fix on higgs (Pi CM5): ffmpeg -hwaccel vaapi -i h264.mp4
+    produces unique decoded P-frames (per-frame fnv1a hashes differ)
+    and zero "error while decoding MB" / "reference frames exceeds
+    max" warnings.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 22:00:00 +0000
+
+daedalus-v4l2 (0.1.0+r20+g3dd0eb0-1) bookworm trixie; urgency=medium
+
+  * Bump to 3dd0eb0 — DAEMON-PPS H.264 SPS/PPS NAL synthesiser.
+    Daemon now reconstructs AnnexB SPS+PPS NAL units from the V4L2
+    stateless H.264 control structs (forwarded by the kernel via
+    a new struct daedalus_h264_meta block in REQ_DECODE) and
+    prepends them to the slice bitstream before feeding libavcodec.
+    Without this, ffmpeg -hwaccel vaapi on H.264 sources failed
+    with "non-existing PPS 0 referenced" even after LIBVA-1/-2
+    routing correctly delivered the request.
+  * Wire protocol: new DAEDALUS_REQ_FLAG_H264_META bit + struct
+    daedalus_h264_meta; daemon and kernel must be installed in
+    lockstep (this package + daedalus-v4l2-dkms 0.1.0+r20+g3dd0eb0).
+  * VP9 / AV1 paths unchanged.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 21:00:00 +0000
+
+daedalus-v4l2 (0.1.0+r18+g481279c-1) bookworm trixie; urgency=medium
+
+  * Bump to 481279c.  Upstream landed the systemd unit + modules-load.d
+    drop-in (packaging/systemd/daedalus-v4l2.{service,modules-load}).
+  * Package now ships /lib/systemd/system/daedalus-v4l2.service and
+    /usr/lib/modules-load.d/daedalus-v4l2.conf.
+  * postinst: daemon-reload, enable the service, trigger
+    systemd-modules-load, and start if /dev/daedalus-v4l2 is already
+    present.  Operator no longer needs to remember the modprobe +
+    systemctl-enable dance after install.
+  * prerm/postrm: stop + disable + daemon-reload.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 16:00:00 +0000
+
+daedalus-v4l2 (0.1.0+r17+gf0cd29a-1) bookworm trixie; urgency=medium
+
+  * Bump to f0cd29a alongside daedalus-v4l2-dkms.  No userspace
+    change — the daemon binary in this release is bit-identical to
+    the f55b2cd one (the f0cd29a commit only touches kernel/).  Bump
+    keeps the userspace + DKMS pkgver lockstep so depmod /
+    LIBVA_DRIVER_NAME selection stays correct on hosts that
+    upgrade.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Tue, 20 May 2026 10:30:00 +0000
+
 daedalus-v4l2 (0.1.0+r16+gf55b2cd-1) bookworm trixie; urgency=medium

  * Initial Debian packaging for the daedalus-v4l2 userspace daemon.
@@ -8,14 +8,18 @@
 # mpv-fourier (and the kdirect bit-exact reference test rig) work
 # end-to-end without a stock-Debian FFmpeg fallback.
 #
-# Conflicts: ffmpeg, libav* — this is a drop-in replacement.  Pi 5 /
-# CM5 (BCM2712) hosts using daedalus_v4l2 + libva-v4l2-request-fourier
-# DON'T strictly need this package (stock Debian ffmpeg + libva path
-# is sufficient for the VAAPI route), but the kdirect bit-exact
-# reference + firefox-fourier / mpv-fourier consumers do.
+# **Private prefix /opt/fourier** (Path A per fourier-debian
+# architecture discussion 2026-05-19).  Stock Debian trixie ships
+# FFmpeg 7.1.x = libavcodec.so.61; this package ships FFmpeg 8.1 =
+# libavcodec.so.62 — different SOVERSION, NOT a drop-in for trixie's
+# KDE/VLC/etc.  Living in /opt/fourier/lib keeps the stock system
+# intact; only fourier-aware consumers (firefox-fourier, mpv-fourier,
+# daedalus-v4l2) RPATH into /opt/fourier/lib.  Postinst drops an
+# ld.so.conf.d entry so dlopen-based consumers (firefox at runtime)
+# find the libs by SONAME without LD_LIBRARY_PATH wrappers.
 #
 # Big build: 25-40 min on a runner.  Output is a single .deb that
-# bundles ffmpeg/ffprobe + libavcodec.so.61 + libavformat.so.61 etc.
+# bundles ffmpeg/ffprobe + libavcodec.so.62 + libavformat.so.62 etc.
 # all together — no split per-library subpackages.  Easier to consume,
 # trades off finer-grained downgrades.
 #
@@ -29,7 +33,7 @@ FFMPEG_VERSION=8.1
 # epoch 2 matches Debian's stock ffmpeg (currently 7:7.1.x in trixie);
 # +rfourier suffix to avoid colliding with upstream/Debian rebuilds.
 PKGVER=2:${FFMPEG_VERSION}+rfourier+gb57fbbe
-PKGREL=1
+PKGREL=2  # pkgrel=2 — Path A move to /opt/fourier prefix (2026-05-19)

 HERE=$(dirname "$(readlink -f "$0")")

@@ -60,10 +64,15 @@ patch -Np1 -i "$HERE/0002-nv15-to-p010-unpack.patch"
 # JACK, GSM, Speex) — not needed on the Fourier fleet, keeps the .deb
 # smaller and the dependency graph tighter.
 ./configure \
-    --prefix=/usr \
-    --libdir=/usr/lib/aarch64-linux-gnu \
-    --shlibdir=/usr/lib/aarch64-linux-gnu \
-    --incdir=/usr/include/aarch64-linux-gnu \
+    --prefix=/opt/fourier \
+    --bindir=/opt/fourier/bin \
+    --libdir=/opt/fourier/lib \
+    --shlibdir=/opt/fourier/lib \
+    --incdir=/opt/fourier/include \
+    --datadir=/opt/fourier/share/ffmpeg \
+    --mandir=/opt/fourier/share/man \
+    --extra-ldexeflags='-Wl,-rpath,/opt/fourier/lib' \
+    --extra-ldsoflags='-Wl,-rpath,/opt/fourier/lib' \
    --disable-debug \
    --disable-static \
    --disable-doc \
@@ -104,7 +113,23 @@ make tools/qt-faststart
 # Stage
 ROOT="$work/pkgroot"
 make DESTDIR="$ROOT" install
-install -Dm755 tools/qt-faststart "$ROOT/usr/bin/qt-faststart"
+install -Dm755 tools/qt-faststart "$ROOT/opt/fourier/bin/qt-faststart"
+
+# ld.so.conf.d entry so dlopen-based consumers (firefox-fourier at
+# runtime) find /opt/fourier/lib/libavcodec.so.62 by SONAME without an
+# LD_LIBRARY_PATH wrapper.  No risk of contaminating stock binaries:
+# stock KDE/VLC link against libavcodec.so.61 (different SONAME), so
+# the loader never sees our .so.62 as a match for their .so.61.
+install -Dm644 /dev/stdin "$ROOT/etc/ld.so.conf.d/fourier.conf" <<EOF
+# fourier campaign: FFmpeg 8.1 fork + libVA fork in private prefix.
+/opt/fourier/lib
+EOF
+
+# Optional /usr/bin shims so users can call ffmpeg-fourier without
+# remembering the /opt path.  No conflict with stock /usr/bin/ffmpeg.
+install -d "$ROOT/usr/bin"
+ln -sf /opt/fourier/bin/ffmpeg   "$ROOT/usr/bin/ffmpeg-fourier"
+ln -sf /opt/fourier/bin/ffprobe  "$ROOT/usr/bin/ffprobe-fourier"

 # Doc
 mkdir -p "$ROOT/usr/share/doc/ffmpeg-v4l2-request-fourier" "$ROOT/DEBIAN"
@@ -143,19 +168,9 @@ Depends: libc6,
         libv4l-0,
         libva2,
         libva-drm2
-Conflicts: ffmpeg, libavcodec61, libavformat61, libavutil59,
-           libswresample5, libswscale8, libavdevice61, libavfilter10,
-           libpostproc58
-Replaces: ffmpeg, libavcodec61, libavformat61, libavutil59,
-          libswresample5, libswscale8, libavdevice61, libavfilter10,
-          libpostproc58
-Provides: ffmpeg (= ${PKGVER}-${PKGREL}),
-          libavcodec.so.61,
-          libavformat.so.61,
-          libavutil.so.59
 Maintainer: Markus Fritsche <mfritsche@reauktion.de>
 Homepage: https://github.com/Kwiboo/FFmpeg
-Description: FFmpeg with V4L2 Request API hwaccel (Kwiboo fork)
+Description: FFmpeg with V4L2 Request API hwaccel (Kwiboo fork, /opt/fourier prefix)
 FFmpeg ${FFMPEG_VERSION} patched with the V4L2 Request API stateless
 video decoder hwaccel — Kwiboo's long-running rebase of Jernej
 Škrabec's v4l2-request patchset onto FFmpeg release tags.
@@ -167,11 +182,40 @@ Description: FFmpeg with V4L2 Request API hwaccel (Kwiboo fork)
 backing FFmpeg, and as the kdirect bit-exact reference in libva-v4l2-
 request-fourier validation.
 .
+ INSTALLED TO /opt/fourier (NOT /usr): this is FFmpeg 8.1 (libav*.so.62)
+ sitting alongside Debian trixie's stock FFmpeg 7.1 (libav*.so.61) —
+ different SONAMEs, no symbol clash.  Consumer binaries RPATH into
+ /opt/fourier/lib; ld.so.conf.d/fourier.conf adds the path to ld.so
+ cache for dlopen-by-SONAME (firefox).  /usr/bin/ffmpeg-fourier and
+ /usr/bin/ffprobe-fourier are convenience symlinks to /opt/fourier/bin.
+ Stock 'ffmpeg' command unaffected.
+ .
 Drops X11/AMF/CUDA/Bluray/JACK/Vulkan/SDL2/Theora/XVid/Speex/JPEG-XL
 per Fourier fleet policy (Wayland + ARM + video-decode focus).
 No 'ffplay' binary; mpv-fourier covers interactive playback.
 EOF

+# ldconfig must be re-run after install so /opt/fourier/lib is in the cache.
+cat > "$ROOT/DEBIAN/postinst" <<'PEOF'
+#!/bin/sh
+set -e
+if [ "$1" = "configure" ]; then
+    ldconfig
+fi
+#DEBHELPER#
+PEOF
+chmod 755 "$ROOT/DEBIAN/postinst"
+
+cat > "$ROOT/DEBIAN/postrm" <<'PEOF'
+#!/bin/sh
+set -e
+if [ "$1" = "remove" ] || [ "$1" = "purge" ]; then
+    ldconfig
+fi
+#DEBHELPER#
+PEOF
+chmod 755 "$ROOT/DEBIAN/postrm"
+
 DEB_OUT="ffmpeg-v4l2-request-fourier_${PKGVER//:/%3a}-${PKGREL}_arm64.deb"
 dpkg-deb --root-owner-group --build "$ROOT" "$HERE/$DEB_OUT"
 echo "built: $HERE/$DEB_OUT"
@@ -10,10 +10,25 @@
 # Upstream fork: https://git.reauktion.de/marfrit/libva-v4l2-request-fourier
 set -euo pipefail

-# Same pin as the Arch PKGBUILD.  de27e95 = "v4l2: log error_idx +
-# failing ctrl id on S_EXT_CTRLS failure" (Phase 8.13 diagnostic).
-UPSTREAM_COMMIT=de27e95571b67ef34619c23a12db4698f9b3454e
-PKGVER=1.0.0+r376+gde27e95
+# Same pin as the Arch PKGBUILD.  c454618 = PR #16 merge "picture,
+# request_pool: transparent OUTPUT-pool resize on bitstream overrun
+# (#15)" — follow-up root-cause fix to #13/#14.  On a mid-stream
+# bitstream-budget overrun (typical cause: SPS-driven resolution
+# upshift in an adaptive-bitrate stream), codec_store_buffer now
+# snapshots the in-flight surface's accumulated bytes, releases its
+# OUTPUT pool slot, calls request_pool_resize (STREAMOFF →
+# REQBUFS(0) → S_FMT with 2×sizeimage hint, capped at 1 GiB, page-
+# aligned → CREATE_BUFS → mmap → media_request_alloc → STREAMON),
+# re-acquires a slot, re-mirrors the surface's source_{data,size,
+# request_fd}, restores the bytes, and continues.  The frame
+# survives instead of being dropped back to libavcodec for surface
+# recreation.  CAPTURE side untouched (per-queue V4L2 streaming
+# independence).
+#
+# Prior pin (2860d75) = PR #14 merge — codec_store_buffer bounds-
+# check floor (#13).
+UPSTREAM_COMMIT=c454618ae11addce2e17b560f4deeacbed067d98
+PKGVER=1.0.0+r390+gc454618
 PKGREL=1

 HERE=$(dirname "$(readlink -f "$0")")
@@ -25,7 +40,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT

 cd "$work"
-curl -sSLfo libva-fourier.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo libva-fourier.tar.gz \
    "https://git.reauktion.de/marfrit/libva-v4l2-request-fourier/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf libva-fourier.tar.gz
 SRCDIR=$(echo libva-v4l2-request-fourier)
@@ -38,6 +53,28 @@ meson setup build \
    -Db_lto=false
 meson compile -C build

+# ---------------------------------------------------------------------------
+# ABI sanity check: the produced .so MUST export __vaDriverInit_1_<MINOR>
+# matching the install target's libva runtime.  Build is expected to run on
+# a Debian trixie runner where <va/va.h>'s VA_MINOR is 22 — see
+# .gitea/workflows/build.yml (runs-on: actrunner-debian-aarch64-bohr).  If a future
+# runner change lands the build on a host with a different libva-dev
+# version, the produced symbol won't bind on the install target and ffmpeg/
+# vainfo/firefox-vaapi will all fail with "has no function
+# __vaDriverInit_1_0".  Fail loud at build time instead of shipping a
+# silently-broken .deb (which is what happened in -1).
+# ---------------------------------------------------------------------------
+SO=$(find build -name 'v4l2_request_drv_video.so' | head -1)
+if ! nm -D --defined-only "$SO" | grep -q '__vaDriverInit_1_22'; then
+    echo "FATAL: built driver does not export __vaDriverInit_1_22."
+    echo "    Build host's <va/va.h> VA_MINOR_VERSION is likely != 22."
+    echo "    Expected runner: actrunner-debian-aarch64-bohr (trixie, libva 2.22)."
+    echo "    Symbol exports found:"
+    nm -D --defined-only "$SO" | grep -i vadriverinit || echo "    (none)"
+    exit 1
+fi
+echo "ABI check: $SO exports __vaDriverInit_1_22 (matches trixie libva 2.22)"
+
 ROOT="$work/pkgroot"
 DESTDIR="$ROOT" meson install -C build

@@ -1,3 +1,51 @@
+libva-v4l2-request-fourier (1.0.0+r380+g9898331-1) bookworm trixie; urgency=medium
+
+  * Bump to 9898331 — LIBVA-2 close.  Adds video_fd_daedalus to
+    any_fd_supports_output_format's probe list in config.c so the
+    profile enumerator actually sees daedalus_v4l2's OUTPUT formats
+    (VP9F + AV1F + S264).  Before this commit, ffmpeg vaapi against
+    H.264 on higgs bailed with "No support for codec h264 profile 578"
+    because RequestQueryConfigProfiles only walked rkvdec/hantro/
+    rpi-hevc-dec/vpu981 fds and never asked daedalus what it could do.
+  * Backward-compatible on RK3399/3588 — new slot gated by
+    HAVE_DAEDALUS_V4L2 *and* video_fd_daedalus >= 0; both false in
+    those deployments.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 19:30:00 +0000
+
+libva-v4l2-request-fourier (1.0.0+r378+gc332d34-2) bookworm trixie; urgency=medium
+
+  * Rebuild on a native Debian trixie runner (actrunner-debian-aarch64-bohr) so
+    the driver picks up trixie's libva-dev (2.22) and exports
+    __vaDriverInit_1_22 — the symbol trixie's libva runtime looks up.
+    Previous -1 build used the Arch CI runner (libva 2.23.0) and
+    exported __vaDriverInit_1_23, which trixie's loader cannot bind:
+    vaInitialize() returns -1 ("has no function __vaDriverInit_1_0")
+    and ffmpeg -hwaccel vaapi fails on startup.
+  * No source change; pure build-env fix.  CI workflow's
+    libva-v4l2-request-fourier-debian job moved from runs-on:
+    arch-aarch64 to runs-on: actrunner-debian-aarch64-bohr; build-deps installed
+    via apt-get instead of pacman.
+  * Hard sanity check kept in build-deb.sh: build fails if the
+    resulting .so doesn't export __vaDriverInit_1_22 (preempts the
+    silent install-then-refuse-to-load failure mode).
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 18:00:00 +0000
+
+libva-v4l2-request-fourier (1.0.0+r378+gc332d34-1) bookworm trixie; urgency=medium
+
+  * Bump to c332d34 — LIBVA-1 per-codec dispatch close.  Pi 5 mixed
+    deployment (rpi-hevc-dec + daedalus_v4l2 both loaded) now correctly
+    opens BOTH decoders: VP9/AV1/H.264 route to daedalus via new 'd'
+    kind, HEVC stays on 'p' (rpi-hevc-dec).  Before this commit
+    find_codec_device picked rpi-hevc-dec as the sole primary and the
+    daedalus_v4l2 slot stayed -1, so VP9/AV1/H.264 frames failed.
+  * Also closes a small fd leak in RequestTerminate (daedalus pair).
+  * Backward-compatible: new branches gated by HAVE_DAEDALUS_V4L2
+    *and* video_fd_daedalus >= 0 — RK3399/RK3588 boxes unaffected.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 17:30:00 +0000
+
 libva-v4l2-request-fourier (1.0.0+r376+gde27e95-1) bookworm trixie; urgency=medium

  * Initial Debian packaging (sibling to existing
@@ -23,7 +23,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT

 cd "$work"
-curl -sSLfo lmcp.tar.gz "https://git.reauktion.de/marfrit/lmcp/archive/${UPSTREAM_TAG}.tar.gz"
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo lmcp.tar.gz "https://git.reauktion.de/marfrit/lmcp/archive/${UPSTREAM_TAG}.tar.gz"
 echo "$LMCP_TARBALL_SHA256  lmcp.tar.gz" | sha256sum -c
 tar xzf lmcp.tar.gz

@@ -33,7 +33,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT

 cd "$work"
-curl -sSLfo mpv.tar.gz \
+curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo mpv.tar.gz \
    "https://github.com/mpv-player/mpv/archive/v${MPV_VERSION}/mpv-${MPV_VERSION}.tar.gz"
 echo "$MPV_TARBALL_SHA256  mpv.tar.gz" | sha256sum -c
 tar xzf mpv.tar.gz
@@ -109,7 +109,7 @@ Depends: ffmpeg-v4l2-request-fourier (>= 2:8.1+rfourier),
         libxkbcommon0, libxext6, libxpresent1,
         libxrandr2, libxss1, libxv1, libx11-6,
         zlib1g
-Conflicts: mpv, libmpv2 | libmpv1
+Conflicts: mpv, libmpv2, libmpv1
 Replaces: mpv, libmpv2, libmpv1
 Provides: mpv (= ${PKGVER}-${PKGREL}), libmpv.so.2
 Maintainer: Markus Fritsche <mfritsche@reauktion.de>