[ooaklee]

Summary

Two goal deliverables in one PR:

1. Community self-compile driver package (sp11-selfcompile-drivers/)

Standalone sources for the three standalone-qualified research drivers:

• vd55g1.ko (VD55G0 front IR sensor), ov13858.ko (rear camera), ps883x.ko (Type-C retimer mux)
• Sources copied verbatim from the tree by scripts/export-package.sh, with per-driver .source-sha git-blob stamps so the package can never silently drift
• check-kernel.sh guards against stock headers — the camera drivers need V4L2_SUBDEV_FL_STOP_RETRY, which exists only in this repo's patched v4l2-subdev core
• Qualcomm USB4 frontend / QMP PHY / Type-C core changes stay in-tree (documented why)

Build-verified on a Surface Pro 11 against linux-headers-7.3.0-jg-1sp11v4-qcom-x1e: all three .ko built with correct vermagic (SMP preempt mod_unload modversions aarch64), check-kernel.sh positive+negative paths exercised.

2. REA evidence corpus (evidence/, 17 reports)

Reverse-engineering evidence from the SurfacePro11 ARM Win11 26100 SurfaceUpdate packages feeding the bounded-port pipeline:

• PMIC glink parity: owner IDs/opcode 0x11 PAN-ACK byte-match PR soc: qcom: pmic_glink: add client-state generation API #83/\u2019s header; Windows has no generation counter (structural teardown instead) \u2014 PR soc: qcom: pmic_glink: add client-state generation API #83's token is a stricter Linux-appropriate equivalent, no mismatch
• QMP quarantine: overlay scheme mapped; one real gap found (frozen overlay never clears quarantine_error); bounded-port outline onto current base incl. gate before the phy: qcom: qmp-combo: sample tunnel clock from the mode register #81 mode-register clock read
• UCSI recovery ladder: 1s\u219215s\u219260s\u219230s settle ladder + post-reset pending re-check (recommended fix) vs merged fix(ucsi): consolidate source-equivalent v26 robustness fixes #77/clk: qcom / usb: typec: propagate reset errors and retry PS883x recovery #79 coverage matrix
• DP cluster port review: config_ctrl LSCLK dead-store (already fixed on drm/msm/dp: port AUX ownership and display state machine from 7.2 research #85), atomic_create_state correct, AUX fault-drain race-safe, no stale APIs
• Audio noise (OE ci: disposition one exact writable-defaults checkpatch finding #66): 180 s speaker cool-down + soft-start fade-in as bounded-fix candidates
• OV13858 power ownership, VD55G0 hblank/illuminator (single 1200 floor stands; value-pool decode is the open follow-up), platform gap inventory

All reports carry per-fact confidence (observed/derived/inferred) and binary addresses. Note: REA MCP tools were unregistered in sub-agent sessions this round; agents fell back to llvm-objdump/python parsing and flagged the deviation per report.

Test plan

• Package builds on-device against repo headers (vermagic match)
• modules_install + depmod + camera/retimer probe on SP11
• Release tarball cut via scripts/export-package.sh once merged

[ooaklee]

All five review findings fixed and pushed:

• P1 failure propagation: set -e loops in all/modules_install; clean uses || exit 1 — failing subdir builds now fail the top level.
• P2 provenance stamps: .gitignore exception added, all three .source-sha files committed.
• P2 HDR override: check-kernel.sh takes HDR from the environment; the Makefile passes its $(HDR) through, so the guard validates the exact tree being compiled against.
• P2 license: export-package.sh copies the kernel COPYING into the package; README gains a License section.
• P3 glob: README uses explicit <version> placeholders.

Re-verified on-device: full rebuild passes (3 .ko), make clean + rebuild works with the new Makefile.

[ooaklee]

License fix pushed: LICENSES/preferred/GPL-2.0 and LICENSES/exceptions/Linux-syscall-note are now in-tree and copied into the exported package — COPYING's references resolve inside the package itself.