mesa-panvk-bifrost: iter10 polish — drop sandbox bypass, pin sha256, tighten loader select

iter10 of the panvk-bifrost campaign. Eliminates the cosmetic '--disable-gpu-sandbox' warning at brave-vulkan launch + pins the Mesa tarball hash + makes the Vulkan ICD selection deterministic across filesystems. PKGBUILD changes (pkgrel: 1 -> 2): - install ICD JSON at /usr/share/vulkan/icd.d/00-panvk-bifrost.json (was: /usr/lib/panvk-bifrost/icd.json — required VK_ICD_FILENAMES, which the GPU sandbox would strip, forcing --disable-gpu-sandbox) - libvulkan_panfrost.so install path unchanged at /usr/lib/panvk-bifrost/ - sha256sums[0] pinned to 1d3c3b8a8363b8cc354175bb4a684ad8b035211cc1d6fa17aeb9b9623c513f89 (mesa-26.0.6.tar.xz from archive.mesa3d.org); patches + brave-vulkan + icd.json remain SKIP since they're in-tree (git-tracked) brave-vulkan changes: - dropped --no-sandbox + --disable-gpu-sandbox: env vars MESA_VK_VERSION_OVERRIDE and PAN_I_WANT_A_BROKEN_VULKAN_DRIVER survive the GPU sandbox boundary (Mesa loader reads them pre-seccomp-lockdown) - dropped VK_ICD_FILENAMES (loader auto-picks via icd.d/ directory scan) - added VK_LOADER_DRIVERS_SELECT='00-panvk-bifrost*' for deterministic ICD selection — Vulkan loader's readdir order is implementation-defined per Khronos LoaderDriverInterface, so the '00-' filename prefix is not spec-backed (ext4 happens to give insertion-order, other filesystems may not). VK_LOADER_DRIVERS_SELECT short-circuits readdir ambiguity. (Phase 5 review hardening.) Test result on ohm (pre-push validation): - brave-vulkan launches Brave without sandbox bypass - seccomp-bpf sandboxes activate normally for utility/renderer processes - 'panvk is not a conformant Vulkan implementation' fires ONCE (loader-select excluded stock ICD from enumeration — only patched driver loads) - GPU process boots, no 'Exiting GPU process' error - Brave runs through full test timeout cleanly README updated to reflect the new install layout + simplified wrapper. Campaign artifacts: ~/src/panvk-bifrost/{phase0_findings_iter10.md, phase8_iteration9_close.md (which iter10 polishes)}. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-20 12:28:29 +02:00
22 changed files with 6611 additions and 4534 deletions
@@ -1,230 +0,0 @@
 #!/bin/bash
 # check-already-published.sh <recipe-dir>
 #
 # Decide whether a given recipe (arch/<name> or debian/<name>) is already
 # present in https://packages.reauktion.de/.  Emits exactly one line to
 # stdout:
 #
 #   skip=1   — package with this version-pkgrel-arch tuple already lives in
 #              the pool; CI should short-circuit.
 #   skip=0   — file is missing or HEAD failed; CI should build + publish.
 #
 # Design notes:
 #   * For Arch recipes we source the PKGBUILD in a clean subshell so
 #     shell expansions (epoch=, ${_pkgver/-/}, pkgname=() arrays) resolve
 #     naturally.  Only the first element of pkgname[] is checked — split
 #     packages share one source tarball / one build, so any-one-missing
 #     forces the full rebuild anyway.
 #   * For Debian recipes we extract the bare top-level PKGVER= /
 #     PKGREL= assignments (plus any other top-level VAR=value lines they
 #     reference) via grep and re-evaluate them in an isolated subshell —
 #     sourcing the entire build-deb.sh would run curl/tar/dpkg-deb
 #     against a tempdir we don't want to materialise here.
 #   * Epoch handling differs by ecosystem: Arch keeps `<epoch>:` in the
 #     pool filename, Debian/reprepro strips it.
 #   * curl --head with -f maps non-2xx to non-zero exit, which is what we
 #     want — 404 means "build it".  -L follows mirrors.  --max-time caps
 #     the worst-case latency per HEAD.
 set -euo pipefail
 REPO_BASE="${REPO_BASE:-https://packages.reauktion.de}"
 HEAD_TIMEOUT="${HEAD_TIMEOUT:-15}"
 RECIPE_DIR="${1:?usage: $0 <recipe-dir>   (e.g. arch/distcc-avahi or debian/lmcp)}"
 # Resolve relative to repo root if a leading path is passed; allow
 # both `arch/foo` and absolute paths.
 if [ ! -d "$RECIPE_DIR" ]; then
  echo "error: recipe dir not found: $RECIPE_DIR" >&2
  exit 2
 fi
 ecosystem="${RECIPE_DIR%%/*}"
 http_head() {
  local url="$1"
  curl -sS -L --max-time "$HEAD_TIMEOUT" -o /dev/null \
       -w '%{http_code}' --head "$url" || echo "000"
 }
 emit() {
  # one-line GITHUB_OUTPUT-compatible kv
  echo "skip=$1"
  exit 0
 }
 case "$ecosystem" in
 arch)
  pkgbuild="$RECIPE_DIR/PKGBUILD"
  [ -f "$pkgbuild" ] || { echo "error: $pkgbuild missing" >&2; exit 2; }
  # Source in a fresh bash to capture variables. Some PKGBUILDs run
  # functions or call commands at top level — keep this fast by
  # restricting PATH and trapping side effects.
  eval "$(
    bash --noprofile --norc -c "
      set +e
      # Stub out anything that might shell out; we only need variable
      # assignments to land.
      cd '$RECIPE_DIR'
      source ./PKGBUILD >/dev/null 2>&1 || true
      # pkgname may be array; print first element.
      if declare -p pkgname 2>/dev/null | grep -q 'declare -a'; then
        first_name=\"\${pkgname[0]}\"
      else
        first_name=\"\$pkgname\"
      fi
      if declare -p arch 2>/dev/null | grep -q 'declare -a'; then
        first_arch=\"\${arch[0]}\"
      else
        first_arch=\"\$arch\"
      fi
      printf 'PB_NAME=%q\n'   \"\$first_name\"
      printf 'PB_VER=%q\n'    \"\$pkgver\"
      printf 'PB_REL=%q\n'    \"\$pkgrel\"
      printf 'PB_EPOCH=%q\n'  \"\${epoch:-}\"
      printf 'PB_ARCH=%q\n'   \"\$first_arch\"
    "
  )"
  if [ -z "${PB_NAME:-}" ] || [ -z "${PB_VER:-}" ] || [ -z "${PB_REL:-}" ]; then
    echo "error: failed to parse PKGBUILD ($RECIPE_DIR)" >&2
    emit 0
  fi
  # Pool arch:
  #   arch=('any')                → any
  #   arch=('aarch64' 'x86_64')   → aarch64 (we publish for both, but the
  #                                 aarch64 artifact is the canonical CI build)
  #   arch=('aarch64')            → aarch64
  case "$PB_ARCH" in
    any) pool_arch=any ;;
    *)   pool_arch=aarch64 ;;
  esac
  # Version string with optional epoch (epoch:pkgver-pkgrel).
  if [ -n "${PB_EPOCH:-}" ]; then
    ver_full="${PB_EPOCH}:${PB_VER}-${PB_REL}"
  else
    ver_full="${PB_VER}-${PB_REL}"
  fi
  # Pool URL path (arch keeps any/aarch64 split; 'any' lands in the
  # aarch64 dir per current marfrit layout — both arches share the
  # blob via the publish-to-both-arches step in build.yml).
  pool_dir="arch/aarch64"
  base_url="${REPO_BASE}/${pool_dir}/${PB_NAME}-${ver_full}-${pool_arch}.pkg.tar"
  for ext in zst xz gz; do
    code=$(http_head "${base_url}.${ext}")
    if [ "$code" = "200" ]; then
      emit 1
    fi
  done
  emit 0
  ;;
 debian)
  bd="$RECIPE_DIR/build-deb.sh"
  ctrl="$RECIPE_DIR/control"
  [ -f "$bd" ] || { echo "error: $bd missing" >&2; exit 2; }
  # Pull top-level `VAR=value` lines until we've passed PKGREL, and
  # only those whose RHS is safe to re-evaluate (no command
  # substitution `$(...)`, no escaped `\$`, no embedded commands like
  # `DESTDIR=... meson ...`).  This deliberately undershoots: we just
  # need PKGVER/PKGREL plus any version vars they reference. Anything
  # else (HERE=$(readlink ...), KERNELVER=\$(uname -r) inside a
  # HEREDOC, etc.) gets dropped.
  assigns=$(awk '
    /^[A-Z_][A-Z0-9_]*=/ {
      # split into LHS and RHS
      eq = index($0, "=")
      lhs = substr($0, 1, eq - 1)
      rhs = substr($0, eq + 1)
      # strip inline `# comment`
      hash = index(rhs, "#")
      if (hash > 1 && substr(rhs, hash-1, 1) == " ") rhs = substr(rhs, 1, hash - 2)
      # reject lines with command-subst or escaped-dollar or naked commands
      if (rhs ~ /\$\(/)   next
      if (rhs ~ /\\\$/)   next
      if (rhs ~ / [a-z]/) next   # e.g. `DESTDIR="$ROOT" meson ...`
      print lhs "=" rhs
      if (lhs == "PKGREL") exit
    }
  ' "$bd")
  eval "$(
    bash --noprofile --norc -c "
      set +e
      $assigns
      printf 'PKGVER=%q\n' \"\${PKGVER:-}\"
      printf 'PKGREL=%q\n' \"\${PKGREL:-}\"
    "
  )"
  if [ -z "${PKGVER:-}" ] || [ -z "${PKGREL:-}" ]; then
    echo "error: failed to parse PKGVER/PKGREL from $bd" >&2
    emit 0
  fi
  # Strip epoch (`N:` prefix) — debian pool filenames omit it.
  ver_no_epoch="${PKGVER#*:}"
  # If PKGVER had no colon, ${PKGVER#*:} returns PKGVER unchanged (bash quirk:
  # the pattern must match for the prefix to be stripped). Guard explicitly.
  case "$PKGVER" in
    *:*) : ;;
    *)   ver_no_epoch="$PKGVER" ;;
  esac
  ver_full="${ver_no_epoch}-${PKGREL}"
  # Architecture: parse control's `Architecture:` field.
  if [ ! -f "$ctrl" ]; then
    # Some recipes ship debian/control instead of ./control
    ctrl="$RECIPE_DIR/debian/control"
  fi
  ctrl_arch=$(grep -m1 '^Architecture:' "$ctrl" 2>/dev/null | awk '{print $2}')
  case "$ctrl_arch" in
    all)            file_arch=all ;;
    arm64|any)      file_arch=arm64 ;;
    amd64)          file_arch=amd64 ;;
    *)              file_arch=arm64 ;;  # conservative default
  esac
  pkg_name=$(basename "$RECIPE_DIR")
  # Compare against the canonical Packages index (what apt actually
  # consults).  reprepro refuses lower-version uploads, so checking
  # only an exact source-pkgrel URL produces an endless-rebuild trap
  # whenever source PKGREL has rolled back below pool head.  We skip
  # if pools published version >= source version-tuple.
  source_full="${ver_full}"
  if [ -n "${PKGVER#*:}" ] && [ "${PKGVER}" != "${PKGVER#*:}" ]; then
    # PKGVER had an epoch — keep it for dpkg --compare-versions.
    source_full="${PKGVER}-${PKGREL}"
  fi
  # Determine suite: most recipes publish to both bookworm and trixie;
  # checking trixie is sufficient (changelogs share Distribution).
  suite="trixie"
  pkg_arch_label="$file_arch"
  [ "$file_arch" = "all" ] && pkg_arch_label="all"
  packages_url="${REPO_BASE}/debian/dists/${suite}/main/binary-arm64/Packages"
  [ "$file_arch" = "amd64" ] && packages_url="${REPO_BASE}/debian/dists/${suite}/main/binary-amd64/Packages"
  pool_ver=$(set +o pipefail; curl -sS --max-time "$HEAD_TIMEOUT" "$packages_url" 2>/dev/null     | awk -v p="$pkg_name" '$1=="Package:" && $2==p {found=1; next} found && $1=="Version:" {print $2; exit}')
  if [ -n "$pool_ver" ] && command -v dpkg >/dev/null &&        dpkg --compare-versions "$pool_ver" ge "$source_full"; then
    echo "pool has $pool_ver >= source $source_full" >&2
    emit 1
  fi
  echo "pool has $pool_ver, source wants $source_full — build" >&2
  emit 0
  ;;
 *)
  echo "error: unsupported ecosystem '$ecosystem' (recipe-dir=$RECIPE_DIR)" >&2
  emit 0
  ;;
 esac
@@ -16,23 +16,13 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: skip if already published
        id: skip-check
        run: |
          set -e
          result=$(./.gitea/scripts/check-already-published.sh arch/distcc-avahi)
          echo "$result" >> "$GITHUB_OUTPUT"
          echo "decision: $result"
      - name: bootstrap runner (idempotent)
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo avahi popt python python-setuptools
      - name: import signing key
        if: steps.skip-check.outputs.skip != '1'
        env:
          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
@@ -47,7 +37,6 @@ jobs:
          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
      - name: install deploy ssh key
        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
        run: |
@@ -57,7 +46,6 @@ jobs:
          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
      - name: makepkg distcc-avahi
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          rm -rf /tmp/build-distcc-avahi
@@ -68,7 +56,6 @@ jobs:
          ls -la *.pkg.tar.* | grep -v "\.sig$"
      - name: sign distcc-avahi
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd /tmp/build-distcc-avahi
@@ -79,7 +66,6 @@ jobs:
          done
      - name: update aarch64 repo db
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          mkdir -p /tmp/arch-stage
@@ -119,7 +105,6 @@ jobs:
          rm -f marfrit.files.sig
      - name: publish to aarch64
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -144,23 +129,13 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: skip if already published
        id: skip-check
        run: |
          set -e
          result=$(./.gitea/scripts/check-already-published.sh debian/lmcp)
          echo "$result" >> "$GITHUB_OUTPUT"
          echo "decision: $result"
      - name: install dpkg
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl
      - name: install hertz deploy ssh key
        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
        run: |
@@ -170,7 +145,6 @@ jobs:
          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
      - name: build lmcp .deb
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd debian/lmcp
@@ -178,7 +152,6 @@ jobs:
          ls -la *.deb
      - name: upload + publish to suites
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -209,23 +182,13 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: skip if already published
        id: skip-check
        run: |
          set -e
          result=$(./.gitea/scripts/check-already-published.sh arch/lmcp)
          echo "$result" >> "$GITHUB_OUTPUT"
          echo "decision: $result"
      - name: bootstrap runner (idempotent)
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo lua lua-socket
      - name: import signing key
        if: steps.skip-check.outputs.skip != '1'
        env:
          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
@@ -240,7 +203,6 @@ jobs:
          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
      - name: install deploy ssh key
        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
        run: |
@@ -250,7 +212,6 @@ jobs:
          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
      - name: makepkg lmcp
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          rm -rf /tmp/build-lmcp
@@ -261,7 +222,6 @@ jobs:
          ls -la *.pkg.tar.* | grep -v "\.sig$"
      - name: sign lmcp
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd /tmp/build-lmcp
@@ -272,7 +232,6 @@ jobs:
          done
      - name: publish lmcp to both arches
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -324,23 +283,13 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: skip if already published
        id: skip-check
        run: |
          set -e
          result=$(./.gitea/scripts/check-already-published.sh arch/claude-his-agent)
          echo "$result" >> "$GITHUB_OUTPUT"
          echo "decision: $result"
      - name: bootstrap runner (idempotent)
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo
      - name: import signing key
        if: steps.skip-check.outputs.skip != '1'
        env:
          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
@@ -355,7 +304,6 @@ jobs:
          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
      - name: install deploy ssh key
        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
        run: |
@@ -365,7 +313,6 @@ jobs:
          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
      - name: makepkg claude-his-agent
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          rm -rf /tmp/build-his
@@ -376,7 +323,6 @@ jobs:
          ls -la *.pkg.tar.* | grep -v "\.sig$"
      - name: sign claude-his-agent
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd /tmp/build-his
@@ -387,7 +333,6 @@ jobs:
          done
      - name: publish claude-his-agent to both arches
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -442,23 +387,13 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: skip if already published
        id: skip-check
        run: |
          set -e
          result=$(./.gitea/scripts/check-already-published.sh arch/ffmpeg-v4l2-request-fourier)
          echo "$result" >> "$GITHUB_OUTPUT"
          echo "decision: $result"
      - name: bootstrap runner (idempotent)
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo nasm
      - name: import signing key
        if: steps.skip-check.outputs.skip != '1'
        env:
          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
@@ -473,7 +408,6 @@ jobs:
          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
      - name: install deploy ssh key
        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
        run: |
@@ -483,7 +417,6 @@ jobs:
          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
      - name: makepkg ffmpeg-v4l2-request-fourier
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          rm -rf /tmp/build-ffmpeg-v4l2
@@ -497,7 +430,6 @@ jobs:
          ls -la *.pkg.tar.* | grep -v "\.sig$"
      - name: sign ffmpeg-v4l2-request-fourier
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd /tmp/build-ffmpeg-v4l2
@@ -508,7 +440,6 @@ jobs:
          done
      - name: update aarch64 repo db
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          mkdir -p /tmp/arch-stage-ffmpeg
@@ -544,7 +475,6 @@ jobs:
          rm -f marfrit.files.sig
      - name: publish to aarch64
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -570,23 +500,13 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: skip if already published
        id: skip-check
        run: |
          set -e
          result=$(./.gitea/scripts/check-already-published.sh arch/libva-v4l2-request-fourier)
          echo "$result" >> "$GITHUB_OUTPUT"
          echo "decision: $result"
      - name: bootstrap runner (idempotent)
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo
      - name: import signing key
        if: steps.skip-check.outputs.skip != '1'
        env:
          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
@@ -601,7 +521,6 @@ jobs:
          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
      - name: install deploy ssh key
        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
        run: |
@@ -611,7 +530,6 @@ jobs:
          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
      - name: makepkg libva-v4l2-request-fourier
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          rm -rf /tmp/build-libva-v4l2
@@ -623,7 +541,6 @@ jobs:
          ls -la *.pkg.tar.* | grep -v "\.sig$"
      - name: sign libva-v4l2-request-fourier
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd /tmp/build-libva-v4l2
@@ -634,7 +551,6 @@ jobs:
          done
      - name: update aarch64 repo db
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          mkdir -p /tmp/arch-stage-libva
@@ -670,7 +586,6 @@ jobs:
          rm -f marfrit.files.sig
      - name: publish to aarch64
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -696,23 +611,13 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: skip if already published
        id: skip-check
        run: |
          set -e
          result=$(./.gitea/scripts/check-already-published.sh arch/mpv-fourier)
          echo "$result" >> "$GITHUB_OUTPUT"
          echo "decision: $result"
      - name: bootstrap runner (idempotent)
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo
      - name: import signing key
        if: steps.skip-check.outputs.skip != '1'
        env:
          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
@@ -727,7 +632,6 @@ jobs:
          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
      - name: install deploy ssh key
        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
        run: |
@@ -737,7 +641,6 @@ jobs:
          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
      - name: configure [marfrit] repo + pre-install ffmpeg-v4l2-request-fourier
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          # mpv-fourier links libavcodec at build time. If the build host pulls
@@ -765,7 +668,6 @@ jobs:
          printf 'y\ny\ny\n' | pacman -S marfrit/ffmpeg-v4l2-request-fourier
      - name: makepkg mpv-fourier
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          rm -rf /tmp/build-mpv
@@ -777,7 +679,6 @@ jobs:
          ls -la *.pkg.tar.* | grep -v "\.sig$"
      - name: sign mpv-fourier
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd /tmp/build-mpv
@@ -788,7 +689,6 @@ jobs:
          done
      - name: update aarch64 repo db
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          mkdir -p /tmp/arch-stage-mpv
@@ -824,7 +724,6 @@ jobs:
          rm -f marfrit.files.sig
      - name: publish to aarch64
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -847,23 +746,13 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: skip if already published
        id: skip-check
        run: |
          set -e
          result=$(./.gitea/scripts/check-already-published.sh debian/claude-his-agent)
          echo "$result" >> "$GITHUB_OUTPUT"
          echo "decision: $result"
      - name: install dpkg
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl
      - name: install hertz deploy ssh key
        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
        run: |
@@ -873,7 +762,6 @@ jobs:
          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
      - name: build claude-his-agent .deb
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd debian/claude-his-agent
@@ -881,7 +769,6 @@ jobs:
          ls -la *.deb
      - name: upload + publish to suites
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -906,41 +793,22 @@ jobs:
  # -------------------------------------------------------------------------
  ffmpeg-v4l2-request-debian:
    needs: ffmpeg-v4l2-request-aarch64
-    runs-on: debian-aarch64
+    runs-on: arch-aarch64
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: skip if already published
        id: skip-check
        run: |
          set -e
          result=$(./.gitea/scripts/check-already-published.sh debian/ffmpeg-v4l2-request-fourier)
          echo "$result" >> "$GITHUB_OUTPUT"
          echo "decision: $result"
      - name: install build-deps (Arch pkg names; build-deb.sh links natively)
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
-          export DEBIAN_FRONTEND=noninteractive
+          retry pacman -Syu --noconfirm --needed \
-          retry apt-get update -qq
+            dpkg openssh rsync curl base-devel git nasm yasm \
-          # Debian build-deps for the FFmpeg fourier-fork build.  These
+            linux-api-headers mesa alsa-lib bzip2 fontconfig fribidi gmp \
-          # map 1:1 to the previous Arch list; libav*-dev intentionally
+            gnutls lame libass dav1d libdrm freetype2 libpulse libva \
-          # absent (we are FFmpeg itself, providing those libs).
+            libvorbis libvpx libwebp x264 x265 libxml2 opus v4l-utils xz zlib
          retry apt-get install -y --no-install-recommends \
              build-essential git pkg-config nasm yasm \
              linux-libc-dev libgl1-mesa-dev libasound2-dev libbz2-dev \
              libfontconfig-dev libfribidi-dev libgmp-dev libgnutls28-dev \
              libmp3lame-dev libass-dev libdav1d-dev libdrm-dev \
              libfreetype-dev libpulse-dev libva-dev libvorbis-dev libvpx-dev \
              libwebp-dev libx264-dev libx265-dev libxml2-dev libopus-dev \
              v4l-utils liblzma-dev zlib1g-dev \
              curl ca-certificates openssh-client rsync dpkg-dev
      - name: install hertz deploy ssh key
        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
        run: |
@@ -950,7 +818,6 @@ jobs:
          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
      - name: build ffmpeg-v4l2-request-fourier .deb
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd debian/ffmpeg-v4l2-request-fourier
@@ -958,7 +825,6 @@ jobs:
          ls -la *.deb
      - name: upload + publish to suites
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -980,38 +846,20 @@ jobs:
  # -------------------------------------------------------------------------
  libva-v4l2-request-fourier-debian:
    needs: libva-v4l2-request-fourier-aarch64
-    # Native Debian trixie runner — the driver bakes __vaDriverInit_1_<MINOR>
+    runs-on: arch-aarch64
    # at compile time from <va/va.h>.  Building on Arch (libva 2.23) produced
    # __vaDriverInit_1_23, which trixie's libva 2.22 runtime cannot bind: the
    # .deb installed but vaInitialize() returned -1 on every host.  A native
    # trixie runner avoids the cross-distro ABI skew entirely.
    runs-on: debian-aarch64
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: skip if already published
        id: skip-check
        run: |
          set -e
          result=$(./.gitea/scripts/check-already-published.sh debian/libva-v4l2-request-fourier)
          echo "$result" >> "$GITHUB_OUTPUT"
          echo "decision: $result"
      - name: install build-deps
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
-          export DEBIAN_FRONTEND=noninteractive
+          retry pacman -Syu --noconfirm --needed \
-          retry apt-get update -qq
+            dpkg openssh rsync curl base-devel git meson ninja pkgconf \
-          retry apt-get install -y --no-install-recommends \
+            libva libdrm systemd-libs
              build-essential meson ninja-build pkg-config \
              libva-dev libdrm-dev \
              curl openssh-client rsync ca-certificates git dpkg-dev
      - name: install hertz deploy ssh key
        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
        run: |
@@ -1021,7 +869,6 @@ jobs:
          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
      - name: build libva-v4l2-request-fourier .deb
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd debian/libva-v4l2-request-fourier
@@ -1029,7 +876,6 @@ jobs:
          ls -la *.deb
      - name: upload + publish to suites
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -1054,51 +900,41 @@ jobs:
  # -------------------------------------------------------------------------
  mpv-fourier-debian:
    needs: mpv-fourier-aarch64
-    runs-on: debian-aarch64
+    runs-on: arch-aarch64
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: skip if already published
        id: skip-check
        run: |
          set -e
          result=$(./.gitea/scripts/check-already-published.sh debian/mpv-fourier)
          echo "$result" >> "$GITHUB_OUTPUT"
          echo "decision: $result"
      - name: install build-deps
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
-          export DEBIAN_FRONTEND=noninteractive
+          retry pacman -Syu --noconfirm --needed \
-          retry apt-get update -qq
+            dpkg openssh rsync curl base-devel git meson ninja python-docutils \
-          # Debian libav*-dev is ABI-compatible with the fourier ffmpeg
+            ladspa wayland-protocols vulkan-headers \
-          # fork at the header level; mpv link-binds against system
+            alsa-lib desktop-file-utils glibc hicolor-icon-theme jack lcms2 \
-          # libav at build time, runtime dlopen picks up the fourier
+            libarchive libass libbluray libcdio libcdio-paranoia libdisplay-info \
-          # libs if installed.  The previous [marfrit] pre-install of
+            libdrm libdvdnav libdvdread libegl libgl libglvnd libjpeg-turbo \
-          # ffmpeg-v4l2-request-fourier under pacman is unnecessary
+            libplacebo libpulse libsixel libva libvdpau libx11 libxext \
-          # under apt: stock Debian libav*-dev provides the trixie
+            libxkbcommon libxpresent libxrandr libxss libxv luajit mesa mujs \
-          # ABI mpv-fourier's binary will encounter.
+            libpipewire rubberband sdl2 openal uchardet vapoursynth \
-          retry apt-get install -y --no-install-recommends \
+            vulkan-icd-loader wayland zlib
-              build-essential git meson ninja-build pkg-config python3-docutils \
+
-              ladspa-sdk wayland-protocols libvulkan-dev libwayland-dev \
+      - name: configure [marfrit] repo + pre-install ffmpeg-v4l2-request-fourier
-              libasound2-dev desktop-file-utils libc6-dev hicolor-icon-theme \
+        run: |
-              libjack-jackd2-dev liblcms2-dev libarchive-dev libass-dev \
+          set -e
-              libbluray-dev libcdio-dev libcdio-paranoia-dev libdisplay-info-dev \
+          curl -sLo /tmp/marfrit.gpg https://packages.reauktion.de/marfrit.gpg
-              libdrm-dev libdvdnav-dev libdvdread-dev libegl-dev libgl-dev \
+          pacman-key --add /tmp/marfrit.gpg
-              libglvnd-dev libjpeg-dev libplacebo-dev libpulse-dev libsixel-dev \
+          pacman-key --lsign-key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C
-              libva-dev libvdpau-dev libx11-dev libxext-dev libxkbcommon-dev \
+          rm -f /tmp/marfrit.gpg
-              libxpresent-dev libxrandr-dev libxss-dev libxv-dev libluajit-5.1-dev \
+          if ! grep -q '^\[marfrit\]' /etc/pacman.conf; then
-              libmujs-dev libpipewire-0.3-dev librubberband-dev libsdl2-dev \
+            printf '\n[marfrit]\nServer = https://packages.reauktion.de/arch/$arch\nSigLevel = Required\n' >> /etc/pacman.conf
-              libopenal-dev libuchardet-dev libvapoursynth-dev liblzma-dev \
+          fi
-              libavcodec-dev libavformat-dev libavutil-dev libswscale-dev libswresample-dev \
+          pacman -Sy --noconfirm
-              zlib1g-dev \
+          rm -f /var/cache/pacman/pkg/ffmpeg-v4l2-request-fourier-*-aarch64.pkg.tar.*
-              curl ca-certificates openssh-client rsync dpkg-dev
+          printf 'y\ny\ny\n' | pacman -S marfrit/ffmpeg-v4l2-request-fourier
      - name: install hertz deploy ssh key
        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
        run: |
@@ -1108,7 +944,6 @@ jobs:
          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
      - name: build mpv-fourier .deb
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd debian/mpv-fourier
@@ -1116,7 +951,6 @@ jobs:
          ls -la *.deb
      - name: upload + publish to suites
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -1139,41 +973,44 @@ jobs:
  # -------------------------------------------------------------------------
  daedalus-v4l2-debian:
    needs: claude-his-debian
-    runs-on: debian-aarch64
+    runs-on: arch-aarch64
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
-      - name: skip if already published
+      - name: install build-deps (sans ffmpeg — see [marfrit] step)
        id: skip-check
        run: |
          set -e
          result=$(./.gitea/scripts/check-already-published.sh debian/daedalus-v4l2)
          echo "$result" >> "$GITHUB_OUTPUT"
          echo "decision: $result"
      - name: install build-deps
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
-          export DEBIAN_FRONTEND=noninteractive
+          # Do NOT pull stock 'ffmpeg' here: the arch-aarch64 runner has
-          retry apt-get update -qq
+          # ffmpeg-v4l2-request-fourier pre-installed from the mpv-aarch64
-          # libav*-dev provide the headers daedalus daemon dlopens at
+          # job (configured via [marfrit]), and pacman -S ffmpeg would
-          # runtime — Debian's stock packages match the trixie ABI the
+          # conflict on the libav* drop-in.  Daedalus build only needs
-          # daemon will encounter on Pi 5 hosts (both ship libavcodec
+          # libavcodec/libavformat headers, which the fourier package
-          # 61.x).  The fourier ffmpeg fork isn't needed here; the
+          # already supplies.  Keep cmake/ninja/pkgconf/libdrm here; the
-          # daemon never link-binds against libav (Option γ — dlopen
+          # ffmpeg-dev equivalent comes via the next step.
-          # at runtime), so any header set with the right struct
+          retry pacman -Syu --noconfirm --needed \
-          # definitions works.
+            dpkg openssh rsync curl base-devel git cmake ninja pkgconf \
-          retry apt-get install -y --no-install-recommends \
+            libdrm
-              build-essential cmake ninja-build pkg-config git \
+
-              libavcodec-dev libavformat-dev libavutil-dev libdrm-dev \
+      - name: ensure ffmpeg-v4l2-request-fourier installed (link-time ABI source)
-              linux-libc-dev \
+        run: |
-              curl ca-certificates openssh-client rsync dpkg-dev
+          set -e
          # Idempotent: pre-install the marfrit fourier ffmpeg so cmake
          # finds libavcodec / libavformat / libavutil headers + .so's.
          # Mirrors mpv-fourier-debian's [marfrit] step.
          curl -sLo /tmp/marfrit.gpg https://packages.reauktion.de/marfrit.gpg
          pacman-key --add /tmp/marfrit.gpg
          pacman-key --lsign-key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C
          rm -f /tmp/marfrit.gpg
          if ! grep -q '^\[marfrit\]' /etc/pacman.conf; then
            printf '\n[marfrit]\nServer = https://packages.reauktion.de/arch/$arch\nSigLevel = Required\n' >> /etc/pacman.conf
          fi
          pacman -Sy --noconfirm
          rm -f /var/cache/pacman/pkg/ffmpeg-v4l2-request-fourier-*-aarch64.pkg.tar.*
          printf 'y\ny\ny\n' | pacman -S --needed marfrit/ffmpeg-v4l2-request-fourier
      - name: install hertz deploy ssh key
        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
        run: |
@@ -1183,7 +1020,6 @@ jobs:
          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
      - name: build daedalus-v4l2 .deb
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd debian/daedalus-v4l2
@@ -1191,7 +1027,6 @@ jobs:
          ls -la *.deb
      - name: upload + publish to suites
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -1214,31 +1049,18 @@ jobs:
  # -------------------------------------------------------------------------
  daedalus-v4l2-dkms-debian:
    needs: daedalus-v4l2-debian
-    runs-on: debian-aarch64
+    runs-on: arch-aarch64
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: skip if already published
        id: skip-check
        run: |
          set -e
          result=$(./.gitea/scripts/check-already-published.sh debian/daedalus-v4l2-dkms)
          echo "$result" >> "$GITHUB_OUTPUT"
          echo "decision: $result"
      - name: install tooling
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
-          export DEBIAN_FRONTEND=noninteractive
+          retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl tar gzip
          retry apt-get update -qq
          retry apt-get install -y --no-install-recommends \
              dpkg-dev openssh-client rsync curl ca-certificates tar gzip
      - name: install hertz deploy ssh key
        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
        run: |
@@ -1248,7 +1070,6 @@ jobs:
          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
      - name: build daedalus-v4l2-dkms .deb
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd debian/daedalus-v4l2-dkms
@@ -1256,7 +1077,6 @@ jobs:
          ls -la *.deb
      - name: upload + publish to suites
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -1290,23 +1110,13 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: skip if already published
        id: skip-check
        run: |
          set -e
          result=$(./.gitea/scripts/check-already-published.sh arch/mesa-panvk-bifrost)
          echo "$result" >> "$GITHUB_OUTPUT"
          echo "decision: $result"
      - name: bootstrap runner (idempotent)
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo
      - name: import signing key
        if: steps.skip-check.outputs.skip != '1'
        env:
          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
@@ -1321,7 +1131,6 @@ jobs:
          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
      - name: install deploy ssh key
        if: steps.skip-check.outputs.skip != '1'
        env:
          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
        run: |
@@ -1331,7 +1140,6 @@ jobs:
          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
      - name: makepkg mesa-panvk-bifrost
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          rm -rf /tmp/build-mesa-panvk-bifrost
@@ -1346,7 +1154,6 @@ jobs:
          ls -la *.pkg.tar.* | grep -v "\.sig$"
      - name: sign mesa-panvk-bifrost
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          cd /tmp/build-mesa-panvk-bifrost
@@ -1357,7 +1164,6 @@ jobs:
          done
      - name: update aarch64 repo db
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          mkdir -p /tmp/arch-stage-mesa-panvk
@@ -1393,7 +1199,6 @@ jobs:
          rm -f marfrit.files.sig
      - name: publish to aarch64
        if: steps.skip-check.outputs.skip != '1'
        run: |
          set -e
          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
@@ -18,12 +18,10 @@ _module=daedalus_v4l2
 # Same pin as arch/daedalus-v4l2 — keep kernel module + daemon
 # bit-versioned together so the chardev wire protocol stays in sync.
-# PROTO_VERSION 0 → 1 at this pin (H.264 B-frame reorder fix); must
+_commit=481279c9bffd19e32c8f3299897e9b63fc5a24aa
 # install both packages atomically.
 _commit=79256dc7ef41f83873ca9c23db20f5888858e65d
-pkgver=0.1.0.r28.79256dc
+pkgver=0.1.0.r18.481279c
-pkgrel=1  # reset for new upstream pin (79256dc — H.264 B-frame reorder fix)
+pkgrel=1  # reset for new upstream pin (481279c — Phase 8.13 close)
 pkgdesc="V4L2 stateless decoder shim kernel module (DKMS) — Pi 5 / CM5"
 arch=('any')
 url="https://git.reauktion.de/reauktion/daedalus-v4l2"
@@ -16,18 +16,17 @@
 pkgname=daedalus-v4l2
 _upstreampkg=daedalus-v4l2
-# Pin the daedalus-v4l2 tip.  79256dc = "kernel + daemon: H.264 B-frame
+# Pin the daedalus-v4l2 tip.  481279c = "Phase 8.13: byte-exact end-to-
-# display reorder fix (closes #6)" — adds the wire-protocol src_pts /
+# end via libva (consumer target hit)" — first commit where the full
-# output_src_pts / RESP_FRAME flags split that lets H.264 streams with
+# ffmpeg -hwaccel vaapi → libva → /dev/video0 → daemon path lands a
-# B-frames preserve display order through libva → kernel → daemon.
+# pixel-correct decoded frame back in ffmpeg.  Promote to a later pin
-# PROTO_VERSION bumps 0 → 1; lock-step userspace + kernel rebuild
+# only after a future phase closes cleanly.
-# REQUIRED (daedalus-v4l2-dkms PKGBUILD pinned to the same commit).
+_commit=481279c9bffd19e32c8f3299897e9b63fc5a24aa
 _commit=79256dc7ef41f83873ca9c23db20f5888858e65d
 # 0.1.0 (pre-1.0) + commit count + short sha.  Bump the .Y on each
 # Phase 8.x close.  pkgver() recomputes at build time.
-pkgver=0.1.0.r28.79256dc
+pkgver=0.1.0.r18.481279c
-pkgrel=1  # reset for new upstream pin (79256dc — H.264 B-frame reorder fix)
+pkgrel=1  # reset for new upstream pin (481279c — Phase 8.13 close)
 pkgdesc="Userspace daemon for the daedalus-v4l2 V4L2 stateless decoder shim (VP9/AV1/H.264 on Pi 5 / CM5)"
 arch=('aarch64')
 url="https://git.reauktion.de/reauktion/daedalus-v4l2"
@@ -18,30 +18,27 @@ This patch adds a sibling init path, `InitV4L2RequestDecoder`, that:
  * looks up the codec via two complementary mechanisms libavcodec
    uses for v4l2_request:
      - **named codec** (`h264_v4l2request`, `vp8_v4l2request`, etc.):
-        the legacy AVCodec-per-hwaccel registration.
+        the legacy AVCodec-per-hwaccel registration. ALARM, Debian,
-      - **generic codec + hw_configs walk**: the modern hwaccel
+        and most distros building with --enable-v4l2-request expose
-        registration. Accepts EITHER AV_HWDEVICE_TYPE_DRM (legacy
+        this (avcodec_find_decoder_by_name lookup).
-        ffmpeg-v4l2-request-fork output prior to FFmpeg 7.1) OR
+      - **generic codec + AV_HWDEVICE_TYPE_DRM** in `hw_configs`:
-        AV_HWDEVICE_TYPE_V4L2REQUEST (FFmpeg 7.1+ dedicated enum,
+        the modern hwaccel registration on some upstream-only ffmpeg
-        value 13 on Kwiboo's no-AMF tree, 14 on upstream-AMF tree).
+        builds.
        Mozilla's bundled libavutil headers may not have the V4L2REQUEST
        enumerator, so the test is on the integer value via `(int)cast`.
    Probes named-codec first (explicit, portable) and falls back to
-    walking the generic codec's `hw_configs` for either device type;
+    walking the generic codec's `hw_configs` for the DRM device type;
-  * creates an hwdevice context bound to `/dev/dri/renderD128`. Uses
+  * creates an `AV_HWDEVICE_TYPE_DRM` hwdevice context bound to
-    integer 13 (V4L2REQUEST as defined by Kwiboo's v4l2-request-n7.1.3
+    `/dev/dri/renderD128` via the new `av_hwdevice_ctx_create` wrapper
-    tree, what our libavcodec61-fourier emits) cast to enum
+    (patch 2/4) and attaches it to the codec context;
    AVHWDeviceType for the av_hwdevice_ctx_create call;
  * reuses the existing `ChooseV4L2PixelFormat` get-format callback
    (already returns `AV_PIX_FMT_DRM_PRIME`) and the existing
    `apply_cropping = 0` constraint.
 `InitV4L2RequestDecoder` is invoked **before** `InitV4L2Decoder` in
 `InitHWDecoderIfAllowed`. On Rockchip mainline it succeeds via either
-mechanism. On Pi4 / Mediatek / vendor-MPP-stateful boards neither
+mechanism (ALARM uses the named codec). On Pi4 / Mediatek /
-mechanism is registered for the codec, the function bails out, and the
+vendor-MPP-stateful boards neither mechanism is registered for the
-existing stateful `InitV4L2Decoder` runs as before. No regression of
+codec, the function bails out, and the existing stateful
-stateful boards.
+`InitV4L2Decoder` runs as before. No regression of stateful boards.
 `mDRMDeviceContext` is unconditionally `av_buffer_unref`'d in
 `ProcessShutdown` (no-op when null). Gated behind
@@ -49,8 +46,9 @@ stateful boards.
 Bug 1969297.
--- a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h	2026-05-21 04:57:59.570946601 +0000
+diff --git a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h b/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h
-+++ b/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h	2026-05-21 04:57:59.876488776 +0000
+--- a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h	2026-03-18 19:22:14.000000000 +0000
 +++ b/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h	2026-04-27 20:43:39.347992674 +0000
@@ -225,7 +225,12 @@
   bool IsLinuxHDR() const;
   MediaResult InitVAAPIDecoder();
@@ -75,8 +73,9 @@ Bug 1969297.
   // If video overlay is used we want to upload SW decoded frames to
   // DMABuf and present it as a external texture to rendering pipeline.
   bool mUploadSWDecodeToDMABuf = false;
--- a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp	2026-05-21 04:57:59.566685221 +0000
+diff --git a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp b/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp
-+++ b/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp	2026-05-21 04:58:00.136004159 +0000
+--- a/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp	2026-04-27 16:09:10.000000000 +0200
 +++ b/dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp	2026-04-29 00:10:00.098884335 +0200
@@ -403,6 +403,129 @@
   return NS_OK;
 }
@@ -91,7 +90,7 @@ Bug 1969297.
 +  }
 +  const char* drmDevice = "/dev/dri/renderD128";
 +  if (mLib->av_hwdevice_ctx_create(&mDRMDeviceContext,
-+                                   (enum AVHWDeviceType)13, drmDevice,
+                                   AV_HWDEVICE_TYPE_DRM, drmDevice,
 +                                   nullptr, 0) < 0) {
 +    FFMPEG_LOG("  av_hwdevice_ctx_create(DRM, %s) failed", drmDevice);
 +    return false;
@@ -144,7 +143,7 @@ Bug 1969297.
 +      for (int i = 0;; i++) {
 +        const AVCodecHWConfig* cfg = mLib->avcodec_get_hw_config(generic, i);
 +        if (!cfg) break;
-+        if (cfg->device_type == AV_HWDEVICE_TYPE_DRM || (int)cfg->device_type == 13 || (int)cfg->device_type == 14) {
+        if (cfg->device_type == AV_HWDEVICE_TYPE_DRM) {
 +          codec = generic;
 +          FFMPEG_LOG("  using generic codec %s with DRM hwaccel", codec->name);
 +          break;
@@ -21,32 +21,27 @@
 # Alternative: boltzmann via his subagent + marfrit-publish.
 pkgname=libva-v4l2-request-fourier
 epoch=1
 _upstreampkg=libva-v4l2-request
-# Pin the fork tip. c454618 = PR #16 merge "picture, request_pool:
+# Pin the fork tip. de27e95 = "v4l2: log error_idx + failing ctrl id
-# transparent OUTPUT-pool resize on bitstream overrun (#15)" —
+# on S_EXT_CTRLS failure" — Phase 8.13 diagnostic that surfaced the
-# follow-up root-cause fix to #13/#14. On a mid-stream bitstream-
+# real root cause of the libva→daedalus_v4l2 request-completion
-# budget overrun (typical cause: SPS-driven resolution upshift in an
+# timeout (turned out the EINVAL libva was logging was a harmless
-# adaptive-bitrate stream), codec_store_buffer now snapshots the in-
+# H264/HEVC probe; actual VP9 stateless control SET worked all along).
 # flight surface's accumulated bytes, releases its OUTPUT pool slot,
 # calls request_pool_resize (STREAMOFF → REQBUFS(0) → S_FMT with
 # 2×sizeimage hint, capped at 1 GiB, page-aligned → CREATE_BUFS →
 # mmap → media_request_alloc → STREAMON), re-acquires a slot, re-
 # mirrors the surface's source_{data,size,request_fd}, restores the
 # bytes, and continues. The frame survives instead of being dropped
 # back to libavcodec for surface recreation. CAPTURE side untouched
 # (per-queue V4L2 streaming independence).
 #
-# Prior pin (2860d75) = PR #14 merge — codec_store_buffer bounds-
+# Prior pin (7ac934e) was iter38b — fresnel-fourier multi-device probe
-# check floor (#13).
+# + MAX_PROFILES bounds-check fix. de27e95 adds the daedalus_v4l2
-_commit=c454618ae11addce2e17b560f4deeacbed067d98
+# probe slot (b5b3acf), the meson option gate (2146341), and the
 # S_EXT_CTRLS diagnostic (de27e95 itself). Backward-compatible on
 # rkvdec / hantro / cedrus / rpi-hevc-dec hosts — daedalus probe is
 # off by default unless the kernel module is present.
 _commit=de27e95571b67ef34619c23a12db4698f9b3454e
 # Project version from meson.build (1.0.0) + commit count + short sha,
 # matching the ffmpeg-v4l2-request-fourier convention. Recomputed at
 # build time by pkgver() below; the static value here is a placeholder
 # so AUR-style consumers see something coherent before src/ exists.
-pkgver=1.0.0.r390.c454618
+pkgver=1.0.0.r376.de27e95
 pkgrel=1
 pkgdesc="VA-API backend for V4L2 stateless decoders (multiplanar fork — fourier umbrella)"
 arch=('aarch64')
@@ -29,7 +29,7 @@
 pkgbase=linux-pinetab2-danctnix-besser
 pkgver=7.0.danctnix1
-pkgrel=5
+pkgrel=6
 pkgdesc='PineTab2 (BESser bes2600 driver patchset, kernel-agent managed)'
 _srcname=linux-pinetab2
 _srctag=v${pkgver%.*}-${pkgver##*.}
@@ -68,7 +68,7 @@ b2sums=('3d9795083c8938f80f480de0d10bfd9c525640e59d5c7f22983de3f12ee42c84c31be90
        'SKIP'
        '71fe98221e802b315e54b4b10d3e8c8f376695a36bae3541d876e5776a37f3fa33c8f8dfa6e51fcbd6f5396add02e5166634165f2351836a0ea0453c172fe56c'
        'SKIP'
-        '50397711a6a3ba522283685a9e7397aeed6663f353f7cba214d4bb88bc98516065b2fca9a36ce13c52644617879f69f39c5305e86db5d9fb25c4dae5434eb9c4'
+        'eb179c03f35a4dbaec2e40036f0033ef04985bb6b14ab22419d68e5caaa5874f2ad14e158f7c5b05added97f60fecde8fb8b7f2a6ced33e031e37352fe776ca6'
        '656a998ab40cb85ee4c00f087b071a91632a6c091da2c84b0f74236b51d2dea6e9db6886625f80ad81dc249d8494ec47cd79d6dd9ea4f5e44f3cde857f861e10')
 export KBUILD_BUILD_HOST=archlinux
@@ -4,34 +4,174 @@ baseline:
  upstream_compat: linux-7.0
  url: https://codeberg.org/DanctNIX/linux-pinetab2
 cumulative:
-  b2sum: 50397711a6a3ba522283685a9e7397aeed6663f353f7cba214d4bb88bc98516065b2fca9a36ce13c52644617879f69f39c5305e86db5d9fb25c4dae5434eb9c4
+  b2sum: eb179c03f35a4dbaec2e40036f0033ef04985bb6b14ab22419d68e5caaa5874f2ad14e158f7c5b05added97f60fecde8fb8b7f2a6ced33e031e37352fe776ca6
  path: cumulative.patch
-  size: 162716
+  size: 279554
-generated_at: '2026-05-18T17:16:06.455474+00:00'
+generated_at: '2026-05-19T13:05:46.476359+00:00'
 host: ohm
 ka_promote_version: 1
 manifest:
  path: fleet/ohm.yaml
-  sha256: da59ac2c965e5ad9c5004a115b10a37abf47ed3ecc8b7f5ab426470d2ee7b442
+  sha256: 9ac04ddd3170418b7b2d2cf7b31ac225a31ed19be4f03e8477bf28b585bae257
 resolved_patches:
 - apply_order: 1
  from_series: true
-  include: driver/bes2600/cumulative-c5x-danctnix/0001-bes2600-besser-cumulative-series.patch
+  include: driver/bes2600/factory-series/0001-bes2600-use-request_firmware-for-factory.txt-read.patch
-  sha256: e477a170567487fef84fe13be5b0a1f0498247ff1f201000d0085a2e49ff9026
+  sha256: a1bc2d13b258709fa37c9ff428dfdc0659464b436470fa2ec69b07edf7592f6f
-  size: 148149
+  size: 5456
 - apply_order: 2
  from_series: true
-  include: driver/bes2600/scan-filter-5ghz-danctnix/0001-bes2600-filter-5ghz-scan-and-allow-single-channel.patch
+  include: driver/bes2600/factory-series/0002-bes2600-default-STANDARD_FACTORY_EFUSE_FLAG-off-for-PineTab2.patch
-  sha256: 31e67569e00daead0784214aced1e077d3270cf1407baa0b330d474e17ec3931
+  sha256: 577d7024ce0b342c4381365872fc29e75a93427ad61223907fead8b829b5a86c
-  size: 7735
+  size: 3499
 - apply_order: 3
  from_series: true
-  include: arch/arm64/xor-neon-ffixed-x18-scs-build-fix-danctnix/0001-arm64-xor-neon-ffixed-x18-build-fix.patch
+  include: driver/bes2600/factory-thread-dev/0001-bes2600-thread-struct-device-through-factory-request_firmware.patch
-  sha256: a49c50f0ebffc499970c24908b832c3e61c96ed87de35b3a82178eff587f94f1
+  sha256: e3fac725e6addc11147341836600c2c5cd0116abba960f34ba50bb8094581c75
-  size: 1574
+  size: 4406
 - apply_order: 4
  from_series: true
  include: driver/bes2600/pm-gate-on-handshake/0001-bes2600-gate-device-LP-mode-entry-on-successful-handshake.patch
  sha256: 9842c0dd66f59fe28898041ba5a816be56965b0665f202410cd461c3e6565474
  size: 3914
 - apply_order: 5
  from_series: true
  include: driver/bes2600/remove-chardev-user-interface/0001-bes2600-remove-userspace-dev-bes2600-character-device-interface.patch
  sha256: c67d340ae5923aada613ea9c5133e3efa3aeb7986749f4bf3619d1752a1b61fb
  size: 22445
 - apply_order: 6
  from_series: true
  include: driver/bes2600/enable-testmode/0001-bes2600-enable-CONFIG_BES2600_TESTMODE-by-default-fix-bitrot.patch
  sha256: 5dee74e8753d332fd380882994ea43aa907d1ff97466b0c48aedf38d4076e446
  size: 6152
 - apply_order: 7
  from_series: true
  include: driver/bes2600/tx-sdio-dma-oob-danctnix/0001-bes2600-bounce-SDIO-TX-buffers-to-avoid-DMA-OOB-read.patch
  sha256: 0dce2fe35450b8376c2d2a7c007119f28c888c1c30b489a67841039caedeebfc
  size: 4544
 - apply_order: 8
  from_series: true
  include: driver/bes2600/factory-drop-kernel-write-danctnix/0001-bes2600-drop-kernel_write-persistence-from-factory-cali-save.patch
  sha256: a7995b38e210af16b73d284a58ab39b8aecac36ff4a671af3d894b1983f961b3
  size: 5704
 - apply_order: 9
  from_series: true
  include: driver/bes2600/drop-dpd-file-paths-danctnix/0001-bes2600-drop-BES2600_WRITE_DPD_TO_FILE-kernel-file-paths.patch
  sha256: 0cd8780c245c97c65e4845e42d712c6256a0449658641aea18e4c7d400f63e41
  size: 9661
 - apply_order: 10
  from_series: true
  include: driver/bes2600/drop-orphan-file-io-danctnix/0001-bes2600-drop-orphan-DATA_DUMP_OBSERVE-and-access_file-IO.patch
  sha256: fd8c297223e6a985c2898f919ae1ab27eb56ab44f09f44d84d75eb35a187527b
  size: 5327
 - apply_order: 11
  from_series: true
  include: driver/bes2600/pm-timeout-silence-danctnix/0001-bes2600-demote-wait-pm-ind-timeout-from-bes_err-to-bes_devel.patch
  sha256: 3a4fd3255facbcef0419e0e0332cb980316529aa5c225b35bcfd244a42736667
  size: 2332
 - apply_order: 12
  from_series: true
  include: driver/bes2600/scan-defer-on-reject-danctnix/0001-bes2600-defer-scan-and-soften-WARN-on-firmware-reject.patch
  sha256: 55e16c176bc147c371a20f57b3a57da38c719d3b42417e88f9de243e10102d35
  size: 8393
 - apply_order: 13
  from_series: true
  include: driver/bes2600/scan-defer-backoff-tune-danctnix/0001-bes2600-widen-scan-defer-backoff-30s-and-decay-on-quiet.patch
  sha256: 70a5b25baaf41c8090701b069c30cbad378883d828bdd06e4eb560a35bc077f1
  size: 4924
 - apply_order: 14
  from_series: true
  include: driver/bes2600/lmac-recover-via-mmc-hw-reset-danctnix/0001-bes2600-recover-wedged-firmware-via-mmc_hw_reset-on-link-break.patch
  sha256: 3decf33c9684b3aba64004d5ad97ae3d54e1d6dc176d0b0ae539036c65e6dc6c
  size: 10604
 - apply_order: 15
  from_series: true
  include: driver/bes2600/lmac-recover-via-mmc-hw-reset-danctnix/0002-bes2600-handle-multi-function-SDIO-cards-in-mmc_hw_reset-bus_reset.patch
  sha256: a1acfcc401afc699a9c3676b6df2ec0f092e78826a32616268f90b509d538e33
  size: 3321
 - apply_order: 16
  from_series: true
  include: driver/bes2600/pm-state-resync-danctnix/0001-bes2600-gate-PM-indication-completion-on-pending-request-and-track-state.patch
  sha256: 049cf3ff9c01fdd10ff73bd18497e14ef0cd8fd1a65486ba86fbc6c1935a5f8e
  size: 10269
 - apply_order: 17
  from_series: true
  include: driver/bes2600/pm-wake-consume-state-danctnix/0001-bes2600-short-circuit-wake-handshake-when-chip-confirmed-ACTIVE.patch
  sha256: c9d19a73816f4c82b418dcd18008176bbb0c49fd4138be53cad45ae142224112
  size: 8100
 - apply_order: 18
  from_series: true
  include: driver/bes2600/pm-detect-firmware-unsupported-danctnix/0001-bes2600-self-detect-firmware-does-not-honor-PSM-skip-cycle.patch
  sha256: 196dc9d51ffea268718a290d434b6237fb60119f10c2b050a58724c8a775c7a8
  size: 9041
 - apply_order: 19
  from_series: true
  include: driver/bes2600/decrypt-storm-fast-recover-danctnix/0001-bes2600-pre-empt-AP-deauth-6-mac80211-reassoc-on-decrypt-fail-storm.patch
  sha256: b57ed316005f402c95ccae8ab24ac761bdf34162d73f108f5790af8f8ad2d1fe
  size: 9249
 - apply_order: 20
  from_series: true
  include: driver/bes2600/connection-loss-fast-recover-danctnix/0001-bes2600-bus_reset-on-connection-loss-storm-to-dodge-assoc-comeback-blackhole.patch
  sha256: cd1eaff97c3f08c58e7b1588e19a12200e8bb2a1f39afe554284f1d818610a67
  size: 12184
 - apply_order: 21
  from_series: true
  include: driver/bes2600/cw1200-fix-backports-danctnix/0001-bes2600-replace-atomic_add-with-atomic_inc-cw1200-backport.patch
  sha256: 3876c9e512f556c7f2e8d4cfaba1d7df2945ee48af8edfab5f8d09d9de9adf23
  size: 3080
 - apply_order: 22
  from_series: true
  include: driver/bes2600/cw1200-fix-backports-danctnix/0002-bes2600-fix-missing-destroy_workqueue-on-error-in-init_common.patch
  sha256: 2b82ecb127748349780404479205b952337c244e715278e6d40471c6ecad7602
  size: 2230
 - apply_order: 23
  from_series: true
  include: driver/bes2600/cw1200-fix-backports-danctnix/0003-bes2600-fix-concurrency-UAF-in-bes2600_hw_scan-and-sched_scan.patch
  sha256: 4c1850ad003ddcac543d3d61edd15c18ccd0cc601367cf4c6dd31e1fbb39ab16
  size: 4476
 - apply_order: 24
  from_series: true
  include: driver/bes2600/sdio-rx-no-relay-danctnix/0001-bes2600-drop-sdio_rx_work-relay-IRQ-bh-direct-no-relay-architecture.patch
  sha256: f1182150c5893f2497f942900b34c9c4aeb8d5901d9786ae2753dcce38ed6c78
  size: 19313
 - apply_order: 25
  from_series: true
  include: driver/bes2600/license-spdx-restore-attribution-danctnix/0001-bes2600-Patch-G-restore-SPDX-identifiers-ST-Ericsson-attribution.patch
  sha256: 91dadab0b58f8b8ad2dca80fd04796d478ecb83ce94a1e4b6e97ef8634d97ef1
  size: 41521
 - apply_order: 26
  from_series: true
  include: driver/bes2600/ba-lock-atomic-danctnix/0001-bes2600-Patch-D-atomicize-ba_lock-counters-drop-the-spinlock.patch
  sha256: a5d4ed2bf545458a756e65670c7eed31997bd0be9262344a10313bee31ea4963
  size: 11987
 - apply_order: 27
  from_series: true
  include: driver/bes2600/ps-state-lock-skip-pm-disabled-danctnix/0001-bes2600-Patch-E-skip-ps_state_lock-when-PSM-known-disabled.patch
  sha256: 18040a563b37cc95c558703f01bfbf6b7fa23a52f2f4f0f8f1254ad4fa0fe0d6
  size: 3396
 - apply_order: 28
  from_series: true
  include: driver/bes2600/rx-list-batch-delivery-danctnix/0001-bes2600-Patch-C2-replace-ieee80211_rx_irqsafe-with-ieee80211_rx_ni.patch
  sha256: ffeffd085a9d052c126a717b845d50120ea302e76c12e53c0c3c891291cababf
  size: 8377
 - apply_order: 29
  from_series: true
  include: driver/bes2600/bh-c-fossil-cleanup-danctnix/0001-bes2600-Patch-H-bh.c-hygiene-cleanup-drop-fossil-blocks-dead-stubs.patch
  sha256: 8fb0c799e3a8ee5ad7bfb647fceaf370c6a1a5f24d8621776fd07bf18a976f81
  size: 21082
 - apply_order: 30
  from_series: true
  include: driver/bes2600/scan-filter-5ghz-danctnix/0001-bes2600-filter-5-GHz-scans-at-the-driver-boundary.patch
  sha256: 31e67569e00daead0784214aced1e077d3270cf1407baa0b330d474e17ec3931
  size: 7735
 - apply_order: 31
  from_series: true
  include: arch/arm64/scs-arm-neon-build-fix/0001-arm64-xor-neon-ffixed-x18-build-fix.patch
  sha256: 105e32edc54743d8107c4dcd846833ae97d2df5f918aebc9fe3e67d6f23249cc
  size: 1562
 - apply_order: 32
  from_series: true
  include: driver/bes2600/queue-pending-record-lock-bh-danctnix/0001-bes2600-take-pending-record-lock-with-bh.patch
-  sha256: 089862e5f6da5783ed0db979144e4fa07cff7f743809a0bebd715c75a3bb8eb5
+  sha256: e0894371c43f750590e1704ae3c77b27b6910548afa4a5b61ebc4d9919580ca2
-  size: 5258
+  size: 5270
 schema_version: 1
@@ -1,328 +0,0 @@
 --- a/src/panfrost/vulkan/panvk_shader.h	2026-04-29 22:19:00.000000000 +0200
 +++ b/src/panfrost/vulkan/panvk_shader.h	2026-05-20 18:52:53.312698258 +0200
@@ -150,6 +150,10 @@
    struct {
 #if PAN_ARCH < 9
       int32_t raw_vertex_offset;
 +      uint32_t num_vertices;       /* iter13: XFB needs per-draw vertex count */
 +      /* aligned_u64 attribute below inserts the 4-byte alignment gap
 +       * after num_vertices automatically — no explicit pad needed. */
 +      aligned_u64 xfb_address[4];  /* iter13: 4 transform feedback buffer base addresses */
 #endif
       int32_t first_vertex;
       int32_t base_instance;
 --- a/src/panfrost/vulkan/panvk_vX_physical_device.c	2026-05-20 19:09:29.711145446 +0200
 +++ b/src/panfrost/vulkan/panvk_vX_physical_device.c	2026-05-20 18:52:54.832720445 +0200
@@ -169,6 +169,7 @@
       .EXT_provoking_vertex = true,
       .EXT_queue_family_foreign = true,
       .EXT_robustness2 = true,
 +      .EXT_transform_feedback = PAN_ARCH < 9,   /* iter13: JM-class only for now */
       .EXT_sampler_filter_minmax = PAN_ARCH >= 10,
       .EXT_scalar_block_layout = true,
       .EXT_separate_stencil_usage = true,
@@ -495,6 +496,10 @@
       .robustImageAccess2 = false,
       .nullDescriptor = true,
 +      /* VK_EXT_transform_feedback (iter13) */
 +      .transformFeedback = PAN_ARCH < 9,
 +      .geometryStreams = false,
 +
       /* VK_KHR_shader_clock */
       .shaderSubgroupClock = device->kmod.dev->props.gpu_can_query_timestamp,
       .shaderDeviceClock = device->kmod.dev->props.timestamp_device_coherent,
@@ -1020,6 +1025,18 @@
       .robustStorageBufferAccessSizeAlignment = 1,
       .robustUniformBufferAccessSizeAlignment = 1,
 +      /* VK_EXT_transform_feedback (iter13) */
 +      .maxTransformFeedbackStreams = 1,
 +      .maxTransformFeedbackBuffers = 4,
 +      .maxTransformFeedbackBufferSize = UINT32_MAX,
 +      .maxTransformFeedbackStreamDataSize = 512,
 +      .maxTransformFeedbackBufferDataSize = 512,
 +      .maxTransformFeedbackBufferDataStride = 2048,
 +      .transformFeedbackQueries = false,
 +      .transformFeedbackStreamsLinesTriangles = false,
 +      .transformFeedbackRasterizationStreamSelect = false,
 +      .transformFeedbackDraw = false,
 +
       /* VK_EXT_shader_object */
       /* We do not currently support VK_EXT_shader_object but this is used
        * internally by vk_shader
 --- a/src/panfrost/vulkan/panvk_vX_shader.c	2026-04-29 22:19:00.000000000 +0200
 +++ b/src/panfrost/vulkan/panvk_vX_shader.c	2026-05-20 18:52:56.556745611 +0200
@@ -21,6 +21,7 @@
 #include "panvk_physical_device.h"
 #include "panvk_sampler.h"
 #include "panvk_shader.h"
 +#include "pan_nir.h"   /* iter13: pan_nir_lower_xfb */
 #include "spirv/nir_spirv.h"
 #include "util/memstream.h"
@@ -100,6 +101,20 @@
    case nir_intrinsic_load_raw_vertex_offset_pan:
       val = load_sysval(b, graphics, bit_size, vs.raw_vertex_offset);
       break;
 +   case nir_intrinsic_load_num_vertices:    /* iter13: XFB index calc */
 +      val = load_sysval(b, graphics, bit_size, vs.num_vertices);
 +      break;
 +   case nir_intrinsic_load_xfb_address: {   /* iter13: XFB buffer N base address */
 +      unsigned idx = nir_intrinsic_base(intr);
 +      switch (idx) {
 +      case 0: val = load_sysval(b, graphics, bit_size, vs.xfb_address[0]); break;
 +      case 1: val = load_sysval(b, graphics, bit_size, vs.xfb_address[1]); break;
 +      case 2: val = load_sysval(b, graphics, bit_size, vs.xfb_address[2]); break;
 +      case 3: val = load_sysval(b, graphics, bit_size, vs.xfb_address[3]); break;
 +      default: return false;
 +      }
 +      break;
 +   }
    case nir_intrinsic_load_layer_id:
       assert(b->shader->info.stage == MESA_SHADER_FRAGMENT);
       val = load_sysval(b, graphics, bit_size, layer_id);
@@ -457,6 +472,7 @@
             core_max_id);
    pan_preprocess_nir(nir, pdev->kmod.dev->props.gpu_id);
 +
 }
 static void
@@ -870,6 +886,18 @@
             nir_var_shader_in | nir_var_shader_out, UINT32_MAX);
    NIR_PASS(_, nir, nir_lower_io, nir_var_shader_in | nir_var_shader_out,
             glsl_type_size, nir_lower_io_use_interpolated_input_intrinsics);
 +
 +#if PAN_ARCH < 9
 +   /* iter13: VK_EXT_transform_feedback — runs AFTER nir_lower_io so that
 +    * shader outputs are now store_output intrinsics that pan_nir_lower_xfb
 +    * can rewrite to nir_store_global+nir_load_xfb_address. */
 +   if (nir->info.stage == MESA_SHADER_VERTEX &&
 +       nir->info.has_transform_feedback_varyings) {
 +      NIR_PASS(_, nir, nir_opt_constant_folding);
 +      NIR_PASS(_, nir, nir_io_add_intrinsic_xfb_info);
 +      NIR_PASS(_, nir, pan_nir_lower_xfb);
 +   }
 +#endif
 }
 static VkResult
@@ -1288,6 +1316,9 @@
       .view_mask = (state && state->rp) ? state->rp->view_mask : 0,
       .robust2_modes = robust2_modes,
       .robust_descriptors = dev->vk.enabled_features.nullDescriptor,
 +      /* iter13: XFB shaders must disable IDVS (matches Panfrost-Gallium). */
 +      .no_idvs = (info->stage == MESA_SHADER_VERTEX) &&
 +                 info->nir->info.has_transform_feedback_varyings,
    };
    switch (info->stage) {
 --- a/src/panfrost/vulkan/panvk_cmd_draw.h	2026-04-29 22:19:00.000000000 +0200
 +++ b/src/panfrost/vulkan/panvk_cmd_draw.h	2026-05-20 18:52:57.748763011 +0200
@@ -135,6 +135,19 @@
    struct panvk_graphics_sysvals sysvals;
 #if PAN_ARCH < 9
 +   /* iter13: VK_EXT_transform_feedback state (JM-class only for now). */
 +   struct {
 +      bool active;
 +      uint32_t buffer_count;
 +      struct {
 +         uint64_t addr;
 +         uint64_t offset;
 +         uint64_t size;
 +      } buffers[4];
 +   } xfb;
 +#endif
 +
 +#if PAN_ARCH < 9
    struct panvk_shader_link link;
 #endif
 --- a/src/panfrost/vulkan/panvk_vX_cmd_draw.c	2026-04-29 22:19:00.000000000 +0200
 +++ b/src/panfrost/vulkan/panvk_vX_cmd_draw.c	2026-05-20 19:10:23.031919662 +0200
@@ -10,6 +10,7 @@
 #include "panvk_entrypoints.h"
 #include "pan_desc.h"
 +#include "pan_compiler.h"   /* PAN_SHADER_OOB_ADDRESS */
 #include "pan_util.h"
 static void
@@ -722,6 +723,35 @@
    set_gfx_sysval(cmdbuf, dirty_sysvals, vs.raw_vertex_offset,
                   info->vertex.raw_offset);
    set_gfx_sysval(cmdbuf, dirty_sysvals, layer_id, info->layer_id);
 +
 +   /* iter13: VK_EXT_transform_feedback sysvals — always set (per draw),
 +    * reflect bound XFB state. set_gfx_sysval is a no-op if value unchanged. */
 +   set_gfx_sysval(cmdbuf, dirty_sysvals, vs.num_vertices, info->vertex.count);
 +   {
 +      const struct panvk_cmd_graphics_state *_gfx = &cmdbuf->state.gfx;
 +      /* iter13: default each XFB buffer address to PAN_SHADER_OOB_ADDRESS
 +       * (= 1<<63). This is the Panfrost-Gallium memory-sink idiom — the
 +       * Bifrost MMU silently discards stores to this address, so a pipeline
 +       * with XFB outputs used in a non-XFB draw (or in an XFB draw with
 +       * fewer bound buffers than the shader declares) is safe instead of
 +       * faulting. See gallium/drivers/panfrost/pan_cmdstream.c PAN_SYSVAL_XFB. */
 +      uint64_t _xa0 = PAN_SHADER_OOB_ADDRESS, _xa1 = PAN_SHADER_OOB_ADDRESS,
 +               _xa2 = PAN_SHADER_OOB_ADDRESS, _xa3 = PAN_SHADER_OOB_ADDRESS;
 +      if (_gfx->xfb.active) {
 +         if (_gfx->xfb.buffer_count > 0 && _gfx->xfb.buffers[0].addr)
 +            _xa0 = _gfx->xfb.buffers[0].addr + _gfx->xfb.buffers[0].offset;
 +         if (_gfx->xfb.buffer_count > 1 && _gfx->xfb.buffers[1].addr)
 +            _xa1 = _gfx->xfb.buffers[1].addr + _gfx->xfb.buffers[1].offset;
 +         if (_gfx->xfb.buffer_count > 2 && _gfx->xfb.buffers[2].addr)
 +            _xa2 = _gfx->xfb.buffers[2].addr + _gfx->xfb.buffers[2].offset;
 +         if (_gfx->xfb.buffer_count > 3 && _gfx->xfb.buffers[3].addr)
 +            _xa3 = _gfx->xfb.buffers[3].addr + _gfx->xfb.buffers[3].offset;
 +      }
 +      set_gfx_sysval(cmdbuf, dirty_sysvals, vs.xfb_address[0], _xa0);
 +      set_gfx_sysval(cmdbuf, dirty_sysvals, vs.xfb_address[1], _xa1);
 +      set_gfx_sysval(cmdbuf, dirty_sysvals, vs.xfb_address[2], _xa2);
 +      set_gfx_sysval(cmdbuf, dirty_sysvals, vs.xfb_address[3], _xa3);
 +   }
 #endif
    if (dyn_gfx_state_dirty(cmdbuf, CB_BLEND_CONSTANTS)) {
 --- a/src/panfrost/vulkan/meson.build	2026-04-29 22:19:00.000000000 +0200
 +++ b/src/panfrost/vulkan/meson.build	2026-05-20 18:53:04.484861338 +0200
@@ -73,6 +73,7 @@
 jm_inc_dir = ['jm']
 jm_files = [
   'jm/panvk_vX_bind_queue.c',
 +  'jm/panvk_vX_cmd_xfb.c',   # iter13
   'jm/panvk_vX_cmd_buffer.c',
   'jm/panvk_vX_cmd_dispatch.c',
   'jm/panvk_vX_cmd_draw.c',
 --- a/src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c	2026-04-29 22:19:00.000000000 +0200
 +++ b/src/panfrost/vulkan/jm/panvk_vX_cmd_buffer.c	2026-05-20 19:10:26.163965149 +0200
@@ -473,5 +473,12 @@
    vk_command_buffer_begin(&cmdbuf->vk, pBeginInfo);
 +#if PAN_ARCH < 9
 +   /* iter13: clear XFB state on Begin so a reused command buffer does not
 +    * inherit stale xfb.buffer_count / xfb.active / xfb.buffers[] from a
 +    * prior recording. */
 +   memset(&cmdbuf->state.gfx.xfb, 0, sizeof(cmdbuf->state.gfx.xfb));
 +#endif
 +
    return VK_SUCCESS;
 }
 --- a/src/panfrost/vulkan/jm/panvk_vX_cmd_xfb.c	2026-05-18 12:50:53.067999996 +0200
 +++ b/src/panfrost/vulkan/jm/panvk_vX_cmd_xfb.c	2026-05-20 19:10:27.175979847 +0200
@@ -0,0 +1,111 @@
 +/*
 + * Copyright © 2026 mfritsche / claude-noether
 + * SPDX-License-Identifier: MIT
 + *
 + * iter13: VK_EXT_transform_feedback command handlers for the JM
 + * architecture path (Bifrost v6/v7 + Valhall-JM v9).
 + *
 + * The runtime contract:
 + *   - vkCmdBindTransformFeedbackBuffersEXT: stash (gpu_addr, offset, size)
 + *     for each slot into cmdbuf->state.gfx.xfb.buffers[].
 + *   - vkCmdBeginTransformFeedbackEXT: set cmdbuf->state.gfx.xfb.active = true.
 + *     Mark sysvals dirty so the next draw re-emits vs.xfb_address[].
 + *   - vkCmdEndTransformFeedbackEXT: set active = false.
 + *
 + * Counter buffers (firstCounterBuffer/counterBufferCount/pCounterBuffers/
 + * pCounterBufferOffsets) are accepted by API but ignored — v1 doesn't
 + * support pause/resume. transformFeedbackDraw is advertised as false.
 + *
 + * Per-draw integration: jm/panvk_vX_cmd_draw.c reads cmdbuf->state.gfx.xfb
 + * and populates vs.xfb_address[i] for shader use. The pan_nir_lower_xfb
 + * pass in panvk_vX_shader.c emits nir_load_xfb_address(i) which lowers
 + * (via panvk_vX_shader.c sysval handler) to a load from the per-draw
 + * sysval push area.
 + */
 +
 +#include "vk_log.h"
 +#include "util/log.h"
 +
 +#include "panvk_cmd_buffer.h"
 +#include "panvk_cmd_draw.h"
 +#include "panvk_buffer.h"
 +#include "panvk_entrypoints.h"
 +
 +VKAPI_ATTR void VKAPI_CALL
 +panvk_per_arch(CmdBindTransformFeedbackBuffersEXT)(
 +   VkCommandBuffer commandBuffer,
 +   uint32_t firstBinding,
 +   uint32_t bindingCount,
 +   const VkBuffer *pBuffers,
 +   const VkDeviceSize *pOffsets,
 +   const VkDeviceSize *pSizes)
 +{
 +   VK_FROM_HANDLE(panvk_cmd_buffer, cmdbuf, commandBuffer);
 +   struct panvk_cmd_graphics_state *gfx = &cmdbuf->state.gfx;
 +
 +   for (uint32_t i = 0; i < bindingCount; i++) {
 +      uint32_t slot = firstBinding + i;
 +      if (slot >= 4)
 +         continue;
 +
 +      VK_FROM_HANDLE(panvk_buffer, buf, pBuffers[i]);
 +      gfx->xfb.buffers[slot].addr = panvk_buffer_gpu_ptr(buf, 0);
 +      gfx->xfb.buffers[slot].offset = pOffsets[i];
 +      gfx->xfb.buffers[slot].size =
 +         (pSizes != NULL && pSizes[i] != VK_WHOLE_SIZE)
 +            ? pSizes[i]
 +            : (buf->vk.size - pOffsets[i]);
 +   }
 +
 +   if (firstBinding + bindingCount > gfx->xfb.buffer_count)
 +      gfx->xfb.buffer_count = firstBinding + bindingCount;
 +}
 +
 +VKAPI_ATTR void VKAPI_CALL
 +panvk_per_arch(CmdBeginTransformFeedbackEXT)(
 +   VkCommandBuffer commandBuffer,
 +   uint32_t firstCounterBuffer,
 +   uint32_t counterBufferCount,
 +   const VkBuffer *pCounterBuffers,
 +   const VkDeviceSize *pCounterBufferOffsets)
 +{
 +   VK_FROM_HANDLE(panvk_cmd_buffer, cmdbuf, commandBuffer);
 +   struct panvk_cmd_graphics_state *gfx = &cmdbuf->state.gfx;
 +
 +   /* Counter buffers ignored in v1 — see VkPhysicalDeviceTransformFeedback
 +    * PropertiesEXT.transformFeedbackDraw = false in panvk_vX_physical_device.c.
 +    * App is spec-compliant if it does not pass counter buffers (which our
 +    * features advertisement allows), but warn loudly if it does so we do not
 +    * silently produce wrong capture state. */
 +   (void)firstCounterBuffer;
 +   (void)pCounterBufferOffsets;
 +   if (counterBufferCount > 0 && pCounterBuffers != NULL) {
 +      mesa_logw("panvk: CmdBeginTransformFeedbackEXT: counter buffers not "
 +                "implemented (transformFeedbackDraw=false); XFB resume will "
 +                "restart at buffer offset 0");
 +   }
 +
 +   gfx->xfb.active = true;
 +   /* Per-draw set_gfx_sysval picks up the change automatically — no
 +    * explicit dirty marking required (set_gfx_sysval uses memcmp +
 +    * BITSET to detect state diffs and re-emit sysvals). */
 +}
 +
 +VKAPI_ATTR void VKAPI_CALL
 +panvk_per_arch(CmdEndTransformFeedbackEXT)(
 +   VkCommandBuffer commandBuffer,
 +   uint32_t firstCounterBuffer,
 +   uint32_t counterBufferCount,
 +   const VkBuffer *pCounterBuffers,
 +   const VkDeviceSize *pCounterBufferOffsets)
 +{
 +   VK_FROM_HANDLE(panvk_cmd_buffer, cmdbuf, commandBuffer);
 +   struct panvk_cmd_graphics_state *gfx = &cmdbuf->state.gfx;
 +
 +   (void)firstCounterBuffer;
 +   (void)counterBufferCount;
 +   (void)pCounterBuffers;
 +   (void)pCounterBufferOffsets;
 +
 +   gfx->xfb.active = false;
 +}
@@ -30,8 +30,8 @@
 pkgname=mesa-panvk-bifrost
 _mesaver=26.0.6
-pkgver=26.0.6.r3
+pkgver=26.0.6.r2
-pkgrel=1
+pkgrel=2
 pkgdesc="Patched Mesa libvulkan_panfrost.so exposing Bifrost-gen Mali to Vulkan apps (panvk-bifrost campaign)"
 arch=('aarch64')
 url="https://github.com/marfrit/panvk-bifrost"
@@ -79,13 +79,11 @@ source=(
    "https://archive.mesa3d.org/mesa-${_mesaver}.tar.xz"
    "0001-panvk-expose-robustness2-nullDescriptor-bifrost.patch"
    "0002-panvk-expose-vulkan-1.1-1.2-on-bifrost.patch"
    "0003-panvk-bifrost-vk-ext-transform-feedback.patch"
    "brave-vulkan"
    "icd.json"
 )
 sha256sums=(
-    'SKIP'  # TODO: pin once we know the upstream tarball is stable. archive.mesa3d.org tarballs are stable, so we can hash-pin in iter10.
+    '1d3c3b8a8363b8cc354175bb4a684ad8b035211cc1d6fa17aeb9b9623c513f89'  # mesa-26.0.6.tar.xz from archive.mesa3d.org, pinned 2026-05-20 (iter10)
    'SKIP'
    'SKIP'
    'SKIP'
    'SKIP'
@@ -109,23 +107,12 @@ prepare() {
    sed -i 's|bool has_vk1_1 = PAN_ARCH >= 10;|bool has_vk1_1 = true;|' src/panfrost/vulkan/panvk_vX_physical_device.c
    sed -i 's|bool has_vk1_2 = PAN_ARCH >= 10;|bool has_vk1_2 = true;|' src/panfrost/vulkan/panvk_vX_physical_device.c
    # iter13: VK_EXT_transform_feedback implementation for Bifrost (PAN_ARCH<9).
    # Applied as a real unified-diff patch — the change is too large for sed.
    # Phase-doc context: ~/src/panvk-bifrost/phase{4,5,6}_iter13_close.md.
    # Unlocks ANGLE-Vulkan → GLES3 → WebGL2 / WebGPU on Brave (chrome://gpu
    # reports "Hardware accelerated" across the board for the affected paths).
    patch -p1 < "${srcdir}/0003-panvk-bifrost-vk-ext-transform-feedback.patch"
    # Sanity-check the patches landed.
    grep -q "KHR_robustness2 = true," src/panfrost/vulkan/panvk_vX_physical_device.c
    grep -q "EXT_robustness2 = true," src/panfrost/vulkan/panvk_vX_physical_device.c
    grep -q "nullDescriptor = true," src/panfrost/vulkan/panvk_vX_physical_device.c
    grep -q "has_vk1_1 = true;" src/panfrost/vulkan/panvk_vX_physical_device.c
    grep -q "has_vk1_2 = true;" src/panfrost/vulkan/panvk_vX_physical_device.c
    # iter13 sanity:
    grep -q "EXT_transform_feedback = PAN_ARCH < 9," src/panfrost/vulkan/panvk_vX_physical_device.c
    grep -q "pan_nir_lower_xfb" src/panfrost/vulkan/panvk_vX_shader.c
    test -f src/panfrost/vulkan/jm/panvk_vX_cmd_xfb.c
 }
 build() {
@@ -155,15 +142,24 @@ package() {
    cd "${srcdir}/mesa-${_mesaver}"
    # Patched lib — co-install path, NOT /usr/lib (to avoid clashing
-    # with stock mesa's libvulkan_panfrost.so).
+    # with stock mesa's libvulkan_panfrost.so binary).
    install -Dm755 build/src/panfrost/vulkan/libvulkan_panfrost.so \
        "$pkgdir/usr/lib/panvk-bifrost/libvulkan_panfrost.so"
-    # Custom ICD JSON. NOT under /usr/share/vulkan/icd.d/ (the default
+    # ICD JSON at the standard Vulkan loader search path. The '00-'
-    # loader search path) — the user has to opt in via VK_ICD_FILENAMES.
+    # filename prefix gives optical priority but is NOT spec-backed —
    # Vulkan loader readdir-order is implementation-defined per Khronos
    # LoaderDriverInterface. The brave-vulkan wrapper sets
    # VK_LOADER_DRIVERS_SELECT='00-panvk-bifrost*' to make the selection
    # deterministic across filesystems. This avoids the VK_ICD_FILENAMES
    # full-path override (whose GPU-sandbox survival is fragile) while
    # still letting the loader work normally. iter10 result + Phase 5
    # hardening.
    install -Dm644 "$srcdir/icd.json" \
-        "$pkgdir/usr/lib/panvk-bifrost/icd.json"
+        "$pkgdir/usr/share/vulkan/icd.d/00-panvk-bifrost.json"
-    # The brave-vulkan launcher wires up env + flags.
+    # The brave-vulkan launcher wires up env + flags. iter10: no longer
    # sets VK_ICD_FILENAMES, no longer passes --no-sandbox /
    # --disable-gpu-sandbox.
    install -Dm755 "$srcdir/brave-vulkan" "$pkgdir/usr/bin/brave-vulkan"
 }
@@ -48,20 +48,23 @@ brave-vulkan --your-flags-here                  # extra args passed through
 The launcher sets:
 - `VK_ICD_FILENAMES=/usr/lib/panvk-bifrost/icd.json` (the patched driver)
 - `PAN_I_WANT_A_BROKEN_VULKAN_DRIVER=1` (Mesa upstream gate)
 - `MESA_VK_VERSION_OVERRIDE=1.2` (apiVersion bump for ANGLE)
- Brave flags: `--use-gl=disabled --enable-features=Vulkan --use-vulkan=native --ozone-platform=x11 --no-sandbox --disable-gpu-sandbox --ignore-gpu-blocklist`
+- Brave flags: `--use-gl=disabled --enable-features=Vulkan --use-vulkan=native --ozone-platform=x11 --ignore-gpu-blocklist`
 iter10 dropped `VK_ICD_FILENAMES` (ICD now at `/usr/share/vulkan/icd.d/00-panvk-bifrost.json` so the Vulkan loader auto-picks it, pinned deterministically via `VK_LOADER_DRIVERS_SELECT='00-panvk-bifrost*'`) and `--no-sandbox` / `--disable-gpu-sandbox` (env vars survive the GPU sandbox boundary without bypass).
 ## What's in the package
 - `/usr/lib/panvk-bifrost/libvulkan_panfrost.so` — patched Mesa Vulkan driver (Mesa 26.0.6 + 2 sed-applied patches)
- `/usr/lib/panvk-bifrost/icd.json` — Vulkan ICD JSON pointing at the patched .so (NOT auto-loaded; only via `VK_ICD_FILENAMES`)
+- `/usr/share/vulkan/icd.d/00-panvk-bifrost.json` — Vulkan ICD JSON pointing at the patched .so (Vulkan loader picks it deterministically via `VK_LOADER_DRIVERS_SELECT='00-panvk-bifrost*'` set by the launcher)
 - `/usr/bin/brave-vulkan` — launcher script
-System Mesa is untouched. The stock `/usr/lib/libvulkan_panfrost.so` and
+System Mesa's binary `/usr/lib/libvulkan_panfrost.so` is untouched. The
-`/usr/share/vulkan/icd.d/panfrost_icd.json` continue to work for any
+stock `panfrost_icd.json` is also untouched and continues to enumerate
-other Vulkan app.
+the same Mali-G52 device — apps see both drivers in
 `vkEnumeratePhysicalDevices` and pick by index (ANGLE picks first, which
 becomes ours by alphabetical priority).
 ## Co-existence
@@ -7,26 +7,35 @@
 #
 # Provided by the mesa-panvk-bifrost package. See:
 #   /usr/share/doc/mesa-panvk-bifrost/README
-#   ~/src/panvk-bifrost/phase8_iteration9_close.md (campaign close)
+#   ~/src/panvk-bifrost/phase8_iteration{9,10}_close.md
 #
 # Usage: brave-vulkan [brave args...]
 # Equivalent to: brave [VULKAN_FLAGS] [your args]
 #
 # iter10 changes vs iter9:
 #   - dropped VK_ICD_FILENAMES env (ICD now at /usr/share/vulkan/icd.d/
 #     with '00-' prefix so the Vulkan loader auto-picks ours first)
 #   - dropped --no-sandbox / --disable-gpu-sandbox (env vars survive the
 #     GPU sandbox boundary, no bypass needed)
 set -e
-# Patched Vulkan driver (from this package) — must point at the custom path
+# Pin the Vulkan ICD selection to our package's ICD. The Vulkan loader's
-# so we don't clash with the stock /usr/share/vulkan/icd.d/panfrost_icd.json
+# readdir-order in /usr/share/vulkan/icd.d/ is implementation-defined
-export VK_ICD_FILENAMES=/usr/lib/panvk-bifrost/icd.json
+# per Khronos LoaderDriverInterface — the '00-' filename prefix is NOT
 # spec-backed. VK_LOADER_DRIVERS_SELECT short-circuits the directory
 # enumeration and picks our ICD deterministically. (Phase 5 review
 # hardening, iter10.)
 export VK_LOADER_DRIVERS_SELECT='00-panvk-bifrost*'
 # PanVk's "I know it's not conformant" gate — the patched driver still
-# refuses to enumerate Bifrost without this env var (Mesa upstream choice,
+# refuses to enumerate Bifrost without this env var (upstream Mesa choice
-# kept for compatibility).
+# for v6/v7, kept for compatibility).
 export PAN_I_WANT_A_BROKEN_VULKAN_DRIVER=1
 # Override apiVersion to 1.2 — ANGLE (Chromium's GL stack) requires
-# device.apiVersion >= 1.1. The patched libvulkan_panfrost.so still has
+# device.apiVersion >= 1.1. Source patches don't move get_api_version()'s
-# a PAN_ARCH>=10 gate inside get_api_version(); easier to override at
+# PAN_ARCH>=10 hardcode; the env var override does.
 # runtime via this Mesa env var than to add a third patch.
 export MESA_VK_VERSION_OVERRIDE=1.2
 # Find the live Plasma session's Xauthority. On a fresh boot the suffix
@@ -55,7 +64,5 @@ exec brave \
    --enable-features=Vulkan \
    --use-vulkan=native \
    --ozone-platform=x11 \
    --no-sandbox \
    --disable-gpu-sandbox \
    --ignore-gpu-blocklist \
    "$@"
@@ -16,7 +16,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 cd "$work"
-curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo his.tar.gz \
+curl -sSLfo his.tar.gz \
    "https://git.reauktion.de/marfrit/claude-his-agent/archive/v${PKGVER}.tar.gz"
 echo "$HIS_TARBALL_SHA256  his.tar.gz" | sha256sum -c
 tar xzf his.tar.gz
@@ -14,9 +14,9 @@
 # Sibling userspace package: ../daedalus-v4l2/build-deb.sh
 set -euo pipefail
-UPSTREAM_COMMIT=79256dc7ef41f83873ca9c23db20f5888858e65d
+UPSTREAM_COMMIT=481279c9bffd19e32c8f3299897e9b63fc5a24aa
-PKGVER=0.1.0+r28+g79256dc
+PKGVER=0.1.0+r18+g481279c
-PKGREL=1  # reset for new upstream pin (79256dc — H.264 B-frame reorder fix); still carries the #64 multi-kernel postinst fix
+PKGREL=1  # reset for new upstream pin (481279c — Phase 8.13 close)
 MODULE_NAME=daedalus_v4l2
 HERE=$(dirname "$(readlink -f "$0")")
@@ -28,7 +28,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 cd "$work"
-curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo daedalus-v4l2.tar.gz \
+curl -sSLfo daedalus-v4l2.tar.gz \
    "https://git.reauktion.de/reauktion/daedalus-v4l2/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf daedalus-v4l2.tar.gz
 SRCDIR=daedalus-v4l2
@@ -78,6 +78,7 @@ set -e
 NAME=${MODULE_NAME}
 VERSION=${PKGVER}
 KERNELVER=\$(uname -r)
 # Yellow + bold ANSI for the warning so it stands out in apt's
 # stream of "Setting up" lines.  Disable colour on non-TTY.
@@ -100,56 +101,29 @@ if [ "\$1" = "configure" ]; then
    dkms add "\$NAME/\$VERSION" 2>/dev/null || true
-    # Enumerate every kernel whose headers are actually present
+    # Don't let autoinstall failure mask the actual problem behind '|| true'.
-    # (/lib/modules/<kver>/build resolves to a directory).  We iterate
+    # Run it, capture the result, then verify post-condition.
-    # all of them — not just \$(uname -r) — so that installing this
+    autoinstall_rc=0
-    # package after a kernel update covers the newly-installed kernel
+    dkms autoinstall "\$NAME/\$VERSION" || autoinstall_rc=\$?
    # too, and so that a later kernel-headers install for a previously
    # uncovered version gets picked up on dpkg-reconfigure.  Without
    # this, autoinstall (which targets only the running kernel) leaves
    # /dev/daedalus-v4l2 absent after a kernel switch + reboot
    # (marfrit/marfrit-packages#64).
    kvers=''
    for d in /lib/modules/*/build; do
        [ -d "\$d" ] || continue
        k=\$(basename "\$(dirname "\$d")")
        kvers="\$kvers \$k"
    done
-    if [ -z "\$kvers" ]; then
+    # Verify the module actually built + installed for the running kernel.
    status=\$(dkms status -m "\$NAME" -v "\$VERSION" -k "\$KERNELVER" 2>/dev/null || true)
    if ! printf '%s\\n' "\$status" | grep -q -E 'installed|loaded'; then
        warn ""
-        warn "No kernels with headers found under /lib/modules/*/build."
+        warn "DKMS build did NOT land for kernel \$KERNELVER."
-        warn "Install kernel headers (e.g. linux-headers-rpi-2712 on Pi OS)"
+        warn "  dkms status -m \$NAME -v \$VERSION -k \$KERNELVER:"
-        warn "then finish with:"
+        warn "    \$(printf '%s' "\$status" | head -1)"
        warn "  sudo dkms autoinstall \$NAME/\$VERSION"
        exit 0
    fi
    failed=''
    for k in \$kvers; do
        dkms autoinstall -k "\$k" "\$NAME/\$VERSION" >/dev/null 2>&1 || true
        s=\$(dkms status -m "\$NAME" -v "\$VERSION" -k "\$k" 2>/dev/null || true)
        if ! printf '%s\\n' "\$s" | grep -q -E 'installed|loaded'; then
            failed="\$failed \$k"
        fi
    done
    if [ -n "\$failed" ]; then
        warn ""
-        warn "DKMS build did NOT land for kernel(s):\$failed"
+        warn "Most likely cause: kernel headers package is missing."
        warn ""
        warn "Most likely cause: kernel headers missing for those versions."
        warn "  Raspberry Pi OS / Pi 5:  apt install linux-headers-rpi-2712"
-        warn "  Debian generic:          apt install linux-headers-<version>"
+        warn "  Debian generic:          apt install linux-headers-\$KERNELVER"
        warn ""
-        warn "After installing headers, finish with:"
+        warn "After installing headers, finish the install with:"
-        for k in \$failed; do
+        warn "  sudo dkms autoinstall \$NAME/\$VERSION"
-            warn "  sudo dkms autoinstall -k \$k \$NAME/\$VERSION"
+        warn "  sudo modprobe daedalus_v4l2"
        done
        warn "  sudo modprobe daedalus_v4l2  (after booting that kernel)"
        warn ""
-        warn "Until then daedalus_v4l2 will NOT be loadable on those kernels"
+        warn "Until then daedalus_v4l2 will NOT be loadable and the"
-        warn "and the userspace daedalus-v4l2 daemon will have nothing to talk to."
+        warn "userspace daedalus-v4l2 daemon will have nothing to talk to."
    fi
 fi
@@ -1,77 +1,3 @@
 daedalus-v4l2-dkms (0.1.0+r28+g79256dc-1) bookworm trixie; urgency=medium
  * Bump to 79256dc — H.264 B-frame display reorder fix (closes
    daedalus-v4l2#6).  libavcodec's H.264 decoder reorders output to
    display order before returning from avcodec_receive_frame; the
    daemon was binding each REQ_DECODE's pixels to the cookie of the
    bitstream that triggered the receive_frame call, not the cookie
    of the bitstream that actually produced the picture.  For B-frame
    sequences this paired cookie N's CAPTURE buffer with cookie N-2's
    pixels and silently lost intermediate frames — visible as
    "2 1 4 3 6 5" frame pairing in mpv / Firefox on Pi CM5.
  * Wire-protocol bump (DAEDALUS_PROTO_VERSION 0 → 1): REQ_DECODE
    gains __u64 src_pts; RESP_FRAME gains __u32 flags +
    __u64 output_src_pts.  Kernel + daemon must install atomically
    (this package + daedalus-v4l2 0.1.0+r28+g79256dc).
  * Carries forward the #64 multi-kernel postinst fix from -2:
    autoinstall for every /lib/modules/*/build that resolves to real
    headers, not just $(uname -r).
  * Closes #64.
 -- Markus Fritsche <mfritsche@reauktion.de>  Thu, 21 May 2026 12:00:00 +0000
 daedalus-v4l2-dkms (0.1.0+r24+gf0d4186-2) bookworm trixie; urgency=medium
  * postinst: autoinstall for every installed kernel with headers, not
    just the running one.  Previously `dkms autoinstall $NAME/$VERSION`
    built only against `$(uname -r)`, so installing the package on
    kernel A and then rebooting into a separately-installed kernel B
    left /lib/modules/B/updates/dkms/ empty — /dev/daedalus-v4l2 absent,
    daedalus daemon nothing to talk to, browser/VAAPI silently falling
    back to software with no obvious diagnostic.  Now we enumerate every
    /lib/modules/*/build that resolves to a real directory and run
    `dkms autoinstall -k <kver>` for each, reporting per-kernel failure
    only when headers are missing.  Closes #64.
 -- Markus Fritsche <mfritsche@reauktion.de>  Thu, 21 May 2026 09:30:00 +0000
 daedalus-v4l2-dkms (0.1.0+r24+gf0d4186-1) bookworm trixie; urgency=medium
  * Bump to f0d4186 — per-ctx vb2 lock fix.  daedalus_queue_init now
    uses ctx->vb_mutex instead of ctx->dev->m2m_lock for each
    vb2_queue's lock, unblocking Firefox's multi-process VAAPI
    clients (they were colliding on the device-wide mutex and one
    would EBUSY-fail S_FMT while another was mid-streamon).
 -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 23:00:00 +0000
 daedalus-v4l2-dkms (0.1.0+r22+g462aa4b-1) bookworm trixie; urgency=medium
  * Bump to 462aa4b — kernel device_run() now calls
    v4l2_ctrl_request_setup() before reading the H.264 stateless
    control values from the bound media_request, so the values
    daedalus ships to the userspace daemon match what the V4L2
    client (libva-v4l2-request-fourier) actually set.  Closes the
    libva→kernel control-binding gap that was causing decoded
    frames to come back as best-effort zero garbage from libavcodec.
  * Wire-ABI lockstep with daedalus-v4l2 0.1.0+r22+g462aa4b.
 -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 22:00:00 +0000
 daedalus-v4l2-dkms (0.1.0+r20+g3dd0eb0-1) bookworm trixie; urgency=medium
  * Bump to 3dd0eb0 — DAEMON-PPS kernel-side changes.  device_run()
    now reads the V4L2 H.264 stateless control values from the bound
    media_request and ships them to the daemon inside REQ_DECODE
    via the new struct daedalus_h264_meta block (gated on
    DAEDALUS_REQ_FLAG_H264_META).  Required for H.264 decode to
    work via the libva-v4l2-request -> daedalus daemon path; daemon
    synthesises AnnexB SPS+PPS NAL units from the structs.
  * Wire-ABI lockstep with daedalus-v4l2 0.1.0+r20+g3dd0eb0 — install
    both packages together.
 -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 21:00:00 +0000
 daedalus-v4l2-dkms (0.1.0+r18+g481279c-1) bookworm trixie; urgency=medium
  * Bump to 481279c in lockstep with the userspace daedalus-v4l2
@@ -11,16 +11,13 @@
 # Upstream repo: https://git.reauktion.de/reauktion/daedalus-v4l2
 set -euo pipefail
-# Same pin as the Arch PKGBUILD.  79256dc = "kernel + daemon: H.264
+# Same pin as the Arch PKGBUILD.  481279c = "Phase 8.13: byte-exact
-# B-frame display reorder fix (closes #6)" — adds the wire-protocol
+# end-to-end via libva (consumer target hit)" — first commit where the
-# src_pts / output_src_pts / RESP_FRAME flags split that lets H.264
+# full ffmpeg -hwaccel vaapi → libva → /dev/video0 → daemon path lands
-# streams with B-frames preserve display order through libva → kernel
+# a pixel-correct decoded frame back in ffmpeg.
-# → daemon.  PROTO_VERSION bumps 0 → 1; lock-step userspace + kernel
+UPSTREAM_COMMIT=481279c9bffd19e32c8f3299897e9b63fc5a24aa
-# rebuild REQUIRED (daedalus-v4l2-dkms build-deb.sh pinned to the same
+PKGVER=0.1.0+r18+g481279c
-# commit).
+PKGREL=1  # reset for new upstream pin (481279c — Phase 8.13 close)
 UPSTREAM_COMMIT=79256dc7ef41f83873ca9c23db20f5888858e65d
 PKGVER=0.1.0+r28+g79256dc
 PKGREL=1  # reset for new upstream pin (79256dc — H.264 B-frame reorder fix)
 HERE=$(dirname "$(readlink -f "$0")")
@@ -31,7 +28,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 cd "$work"
-curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo daedalus-v4l2.tar.gz \
+curl -sSLfo daedalus-v4l2.tar.gz \
    "https://git.reauktion.de/reauktion/daedalus-v4l2/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf daedalus-v4l2.tar.gz
 SRCDIR=daedalus-v4l2
@@ -1,79 +1,3 @@
 daedalus-v4l2 (0.1.0+r28+g79256dc-1) bookworm trixie; urgency=medium
  * Bump to 79256dc — H.264 B-frame display reorder fix (closes
    daedalus-v4l2#6 + #4 menu controls).  Daemon side: the
    avcodec_send_packet → receive_frame loop now stamps pkt->pts =
    req->src_pts so libavcodec's display-ordered frame->pts identifies
    which OUTPUT bitstream's pixels each drained frame belongs to.
    chardev_client maintains a (src_pts → cookie) lookup table so the
    daemon can ship pixels to the cookie of the *originating*
    bitstream, not the cookie of whatever REQ triggered the
    receive_frame call.  Multiple RESP_FRAME messages per REQ_DECODE
    are now possible (one for the just-consumed src, one or more for
    drained pixels).
  * Wire-protocol bump (DAEDALUS_PROTO_VERSION 0 → 1): REQ_DECODE
    gains __u64 src_pts; RESP_FRAME gains __u32 flags +
    __u64 output_src_pts.  Daemon + kernel must install atomically
    (this package + daedalus-v4l2-dkms 0.1.0+r28+g79256dc).
  * Also subsumes 79256dc's predecessor 7ff2d89 — H.264 DECODE_MODE +
    START_CODE menu-control registration that retires the
    "Unable to set control(s) error_idx=2/2" warning libva-v4l2-
    request emitted on every context init.
 -- Markus Fritsche <mfritsche@reauktion.de>  Thu, 21 May 2026 12:00:00 +0000
 daedalus-v4l2 (0.1.0+r24+gf0d4186-1) bookworm trixie; urgency=medium
  * Bump to f0d4186 — kernel per-ctx vb2 lock fix.  daedalus_queue_init
    was wiring src_vq->lock and dst_vq->lock to ctx->dev->m2m_lock (a
    device-wide mutex), serialising every vb2 ioctl across all
    concurrent clients of /dev/video0.  For Firefox (which spawns
    separate content + RDD + GPU processes that each open the device
    and run libva probe simultaneously), one libva session's
    S_FMT(OUTPUT_MPLANE) hit EBUSY while another was mid-streamon —
    Firefox VAAPI playback fell apart at startup.
  * Fix gives each open() its own ctx->vb_mutex; vb2 ioctls run
    independently per client.  Matches cedrus / rkvdec / hantro
    pattern.
  * Verified on higgs: Firefox YouTube playback engages VAAPI cleanly,
    sustained ~230 fps decode at 640x368 through the daedalus daemon,
    zero EBUSY in stderr or daemon journal.
 -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 23:00:00 +0000
 daedalus-v4l2 (0.1.0+r22+g462aa4b-1) bookworm trixie; urgency=medium
  * Bump to 462aa4b — kernel-side fix for control-binding gap that
    closes the libva→daemon SPS/PPS pipeline.  Kernel device_run now
    calls v4l2_ctrl_request_setup() before reading ctrl->p_cur, so
    the daemon's daedalus_h264_meta block actually carries THIS
    request's V4L2 stateless H.264 control values instead of stale
    /default ones.  Pairs with libva-v4l2-request-fourier r382+gc1bb444
    (Fix 3 + Fix 4 from issue libva-v4l2-request-fourier#8).
  * After-fix on higgs (Pi CM5): ffmpeg -hwaccel vaapi -i h264.mp4
    produces unique decoded P-frames (per-frame fnv1a hashes differ)
    and zero "error while decoding MB" / "reference frames exceeds
    max" warnings.
 -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 22:00:00 +0000
 daedalus-v4l2 (0.1.0+r20+g3dd0eb0-1) bookworm trixie; urgency=medium
  * Bump to 3dd0eb0 — DAEMON-PPS H.264 SPS/PPS NAL synthesiser.
    Daemon now reconstructs AnnexB SPS+PPS NAL units from the V4L2
    stateless H.264 control structs (forwarded by the kernel via
    a new struct daedalus_h264_meta block in REQ_DECODE) and
    prepends them to the slice bitstream before feeding libavcodec.
    Without this, ffmpeg -hwaccel vaapi on H.264 sources failed
    with "non-existing PPS 0 referenced" even after LIBVA-1/-2
    routing correctly delivered the request.
  * Wire protocol: new DAEDALUS_REQ_FLAG_H264_META bit + struct
    daedalus_h264_meta; daemon and kernel must be installed in
    lockstep (this package + daedalus-v4l2-dkms 0.1.0+r20+g3dd0eb0).
  * VP9 / AV1 paths unchanged.
 -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 21:00:00 +0000
 daedalus-v4l2 (0.1.0+r18+g481279c-1) bookworm trixie; urgency=medium
  * Bump to 481279c.  Upstream landed the systemd unit + modules-load.d
@@ -10,25 +10,10 @@
 # Upstream fork: https://git.reauktion.de/marfrit/libva-v4l2-request-fourier
 set -euo pipefail
-# Same pin as the Arch PKGBUILD.  c454618 = PR #16 merge "picture,
+# Same pin as the Arch PKGBUILD.  de27e95 = "v4l2: log error_idx +
-# request_pool: transparent OUTPUT-pool resize on bitstream overrun
+# failing ctrl id on S_EXT_CTRLS failure" (Phase 8.13 diagnostic).
-# (#15)" — follow-up root-cause fix to #13/#14.  On a mid-stream
+UPSTREAM_COMMIT=de27e95571b67ef34619c23a12db4698f9b3454e
-# bitstream-budget overrun (typical cause: SPS-driven resolution
+PKGVER=1.0.0+r376+gde27e95
 # upshift in an adaptive-bitrate stream), codec_store_buffer now
 # snapshots the in-flight surface's accumulated bytes, releases its
 # OUTPUT pool slot, calls request_pool_resize (STREAMOFF →
 # REQBUFS(0) → S_FMT with 2×sizeimage hint, capped at 1 GiB, page-
 # aligned → CREATE_BUFS → mmap → media_request_alloc → STREAMON),
 # re-acquires a slot, re-mirrors the surface's source_{data,size,
 # request_fd}, restores the bytes, and continues.  The frame
 # survives instead of being dropped back to libavcodec for surface
 # recreation.  CAPTURE side untouched (per-queue V4L2 streaming
 # independence).
 #
 # Prior pin (2860d75) = PR #14 merge — codec_store_buffer bounds-
 # check floor (#13).
 UPSTREAM_COMMIT=c454618ae11addce2e17b560f4deeacbed067d98
 PKGVER=1.0.0+r390+gc454618
 PKGREL=1
 HERE=$(dirname "$(readlink -f "$0")")
@@ -40,7 +25,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 cd "$work"
-curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo libva-fourier.tar.gz \
+curl -sSLfo libva-fourier.tar.gz \
    "https://git.reauktion.de/marfrit/libva-v4l2-request-fourier/archive/${UPSTREAM_COMMIT}.tar.gz"
 tar xzf libva-fourier.tar.gz
 SRCDIR=$(echo libva-v4l2-request-fourier)
@@ -53,28 +38,6 @@ meson setup build \
    -Db_lto=false
 meson compile -C build
 # ---------------------------------------------------------------------------
 # ABI sanity check: the produced .so MUST export __vaDriverInit_1_<MINOR>
 # matching the install target's libva runtime.  Build is expected to run on
 # a Debian trixie runner where <va/va.h>'s VA_MINOR is 22 — see
 # .gitea/workflows/build.yml (runs-on: actrunner-debian-aarch64-bohr).  If a future
 # runner change lands the build on a host with a different libva-dev
 # version, the produced symbol won't bind on the install target and ffmpeg/
 # vainfo/firefox-vaapi will all fail with "has no function
 # __vaDriverInit_1_0".  Fail loud at build time instead of shipping a
 # silently-broken .deb (which is what happened in -1).
 # ---------------------------------------------------------------------------
 SO=$(find build -name 'v4l2_request_drv_video.so' | head -1)
 if ! nm -D --defined-only "$SO" | grep -q '__vaDriverInit_1_22'; then
    echo "FATAL: built driver does not export __vaDriverInit_1_22."
    echo "    Build host's <va/va.h> VA_MINOR_VERSION is likely != 22."
    echo "    Expected runner: actrunner-debian-aarch64-bohr (trixie, libva 2.22)."
    echo "    Symbol exports found:"
    nm -D --defined-only "$SO" | grep -i vadriverinit || echo "    (none)"
    exit 1
 fi
 echo "ABI check: $SO exports __vaDriverInit_1_22 (matches trixie libva 2.22)"
 ROOT="$work/pkgroot"
 DESTDIR="$ROOT" meson install -C build
@@ -1,51 +1,3 @@
 libva-v4l2-request-fourier (1.0.0+r380+g9898331-1) bookworm trixie; urgency=medium
  * Bump to 9898331 — LIBVA-2 close.  Adds video_fd_daedalus to
    any_fd_supports_output_format's probe list in config.c so the
    profile enumerator actually sees daedalus_v4l2's OUTPUT formats
    (VP9F + AV1F + S264).  Before this commit, ffmpeg vaapi against
    H.264 on higgs bailed with "No support for codec h264 profile 578"
    because RequestQueryConfigProfiles only walked rkvdec/hantro/
    rpi-hevc-dec/vpu981 fds and never asked daedalus what it could do.
  * Backward-compatible on RK3399/3588 — new slot gated by
    HAVE_DAEDALUS_V4L2 *and* video_fd_daedalus >= 0; both false in
    those deployments.
 -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 19:30:00 +0000
 libva-v4l2-request-fourier (1.0.0+r378+gc332d34-2) bookworm trixie; urgency=medium
  * Rebuild on a native Debian trixie runner (actrunner-debian-aarch64-bohr) so
    the driver picks up trixie's libva-dev (2.22) and exports
    __vaDriverInit_1_22 — the symbol trixie's libva runtime looks up.
    Previous -1 build used the Arch CI runner (libva 2.23.0) and
    exported __vaDriverInit_1_23, which trixie's loader cannot bind:
    vaInitialize() returns -1 ("has no function __vaDriverInit_1_0")
    and ffmpeg -hwaccel vaapi fails on startup.
  * No source change; pure build-env fix.  CI workflow's
    libva-v4l2-request-fourier-debian job moved from runs-on:
    arch-aarch64 to runs-on: actrunner-debian-aarch64-bohr; build-deps installed
    via apt-get instead of pacman.
  * Hard sanity check kept in build-deb.sh: build fails if the
    resulting .so doesn't export __vaDriverInit_1_22 (preempts the
    silent install-then-refuse-to-load failure mode).
 -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 18:00:00 +0000
 libva-v4l2-request-fourier (1.0.0+r378+gc332d34-1) bookworm trixie; urgency=medium
  * Bump to c332d34 — LIBVA-1 per-codec dispatch close.  Pi 5 mixed
    deployment (rpi-hevc-dec + daedalus_v4l2 both loaded) now correctly
    opens BOTH decoders: VP9/AV1/H.264 route to daedalus via new 'd'
    kind, HEVC stays on 'p' (rpi-hevc-dec).  Before this commit
    find_codec_device picked rpi-hevc-dec as the sole primary and the
    daedalus_v4l2 slot stayed -1, so VP9/AV1/H.264 frames failed.
  * Also closes a small fd leak in RequestTerminate (daedalus pair).
  * Backward-compatible: new branches gated by HAVE_DAEDALUS_V4L2
    *and* video_fd_daedalus >= 0 — RK3399/RK3588 boxes unaffected.
 -- Markus Fritsche <mfritsche@reauktion.de>  Wed, 20 May 2026 17:30:00 +0000
 libva-v4l2-request-fourier (1.0.0+r376+gde27e95-1) bookworm trixie; urgency=medium
  * Initial Debian packaging (sibling to existing
@@ -23,7 +23,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 cd "$work"
-curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo lmcp.tar.gz "https://git.reauktion.de/marfrit/lmcp/archive/${UPSTREAM_TAG}.tar.gz"
+curl -sSLfo lmcp.tar.gz "https://git.reauktion.de/marfrit/lmcp/archive/${UPSTREAM_TAG}.tar.gz"
 echo "$LMCP_TARBALL_SHA256  lmcp.tar.gz" | sha256sum -c
 tar xzf lmcp.tar.gz
@@ -33,7 +33,7 @@ work=$(mktemp -d)
 trap "rm -rf $work" EXIT
 cd "$work"
-curl --connect-timeout 10 --max-time 600 --retry 3 --retry-delay 5 -sSLfo mpv.tar.gz \
+curl -sSLfo mpv.tar.gz \
    "https://github.com/mpv-player/mpv/archive/v${MPV_VERSION}/mpv-${MPV_VERSION}.tar.gz"
 echo "$MPV_TARBALL_SHA256  mpv.tar.gz" | sha256sum -c
 tar xzf mpv.tar.gz