chriskearney · Oct 26, 2026
@@ -10,7 +10,7 @@
 # No profile selection substitutes another Mac's firmware or calibration.
 pkgname=mesa-m3
 pkgver=26.1.4.m3.2
-pkgrel=8
+pkgrel=9
 _commit=7ff89a4da387bd561b78efd5f09c98ca8ae18538
 pkgdesc="Mesa in /opt/mesa-m3 for the M3 Pro (G15S) and M3 (G15G) GPUs; used by uwsm sessions on T6030, and on T8122 when opted in"
 arch=('aarch64')
@@ -85,7 +85,7 @@ sha256sums=('7ed24969985dce91f089d34dbe1c55cbcb8c95765e3e5bc0f268d27fbead2222'
             '10abda78df16e650a77443f50cc46a15e418c42d4d9680c6a61616b232c9bdef'
             '6c98fab6f9d70449bd7f5258c34eac773836908e060ce5bef86dc5b0ce595e61'
             '826016665cd0424a614b67add921c0c79c3c698a4d104ea5712518449b75f27c'
-            '9cbc38f4bee27ab72d4a288f2741ab1eeb70112ca473a5c98a9695cdfcbe56f7'
+            'cb9902bc04870dd0c76208034093afecf3bdfd9d566db5036fa1c9bcda34ad65'
             '6144af8b2e0f04ea615e8c4149e69c45ac49e630c46b2a58f0d1095d977798b2'
             '530948fc1a124de21c030a497e2ef5351742ba4ad4653484fe30fd1697ad7141'
             '644cf4a5ab57b7badec75843e2899b68d41490c4851d6885227180d6090c25ea'
@@ -97,7 +97,7 @@ sha256sums=('7ed24969985dce91f089d34dbe1c55cbcb8c95765e3e5bc0f268d27fbead2222'
             '2a15cfdbc160b78e5a3a8e99d5898d40a54db28592f1a4ce04a600990a731f87'
             '7eaae7de828e15208fccc84db2b910f38bb1288176419f7af7f4675b5c542ce4'
             'c888e9dce99e8379aa21e9c5895cbe1b7e879a9319bca144193eddc66f9d4051'
-            'e80947130044c2dc3671c24c7bff4f523dcc033f7e96f71e334d89a663e2742e')
+            'e608999c60f1363fc4bcac14151348d92717b88239f8dc300b7ab125e55d910a')
 
 # The qualified M3 Pro build's generated kernel files and libclc. build() stops
 # when one of ours differs. libagx_shaders.c is compared through kernel-digest.py:

@@ -68,8 +68,13 @@
 # user-setup it exports nothing: the session's own Mesa setup, which it uses,
 # decides. The state file says which (fallback=software|none).
 #
-# A file opt-out (/etc/mesa-m3/disable or the user's mesa-m3/disable) on a
-# J613 (T8122) or a J516S (T6030) is the exception: when the same node,
+# A matching native mesa-aurora/vulkan-aurora package set at the reviewed
+# version floor selects /usr automatically on J613/J615 (T8122) and J516S
+# (T6030), subject to the same checks below. An explicit legacy profile,
+# user provider/software choice, mesa_m3=off or nomodeset prevents that default.
+# Package identity is not hardware qualification of every listed board.
+# A file opt-out (/etc/mesa-m3/disable or the user's mesa-m3/disable) remains
+# a separate manual route: when the same node,
 # display, kernel-log, user-setup and same-boot attempt checks pass and
 # mesa-m3-system-check admits /usr, the session keeps system Mesa
 # (fallback=none, no new attempt). The whole check runs in its own sh and is
@@ -110,6 +115,7 @@ mesa_m3_gate() {
 	fi
 	case " $(cat "$_mm3_root/proc/cmdline" 2>/dev/null) " in
 	*" mesa_m3=off "*) echo "opt-out mesa_m3=off is on the kernel command line"; return 1 ;;
+	*" nomodeset "*) echo "opt-out nomodeset is on the kernel command line"; return 1 ;;
 	esac
 
 	# The SoC decides which GPU and display compatibles count: never a mix.
@@ -385,30 +391,74 @@ _mm3_legacy_attempt_clear() {
 	return 0
 }
 
-# File opt-out on J613/T8122 or J516S/T6030 may keep the system Mesa. Prints
+# The normal signed-package boundary owns this cohort, not a per-build hash
+# list. The kernel admits firmware/resources, and native Mesa validates its
+# chip/USC/HAL/features contract when the clean-environment helper opens it.
+# Require matching split versions and ownership of the real /usr providers.
+_mm3_native_packages() {
+	_mm3_pm=$1/usr/bin/pacman
+	_mm3_vc=$1/usr/bin/vercmp
+	[ -x "$_mm3_pm" ] && [ -x "$_mm3_vc" ] || return 1
+	_mm3_pkgroot=${1:-/}
+	_mm3_mv=$("$_mm3_pm" --root "$_mm3_pkgroot" -Q mesa-aurora 2>/dev/null) || return 1
+	_mm3_vv=$("$_mm3_pm" --root "$_mm3_pkgroot" -Q vulkan-aurora 2>/dev/null) || return 1
+	case $_mm3_mv in 'mesa-aurora '*) _mm3_mv=${_mm3_mv#mesa-aurora } ;; *) return 1 ;; esac
+	case $_mm3_vv in 'vulkan-aurora '*) _mm3_vv=${_mm3_vv#vulkan-aurora } ;; *) return 1 ;; esac
+	[ "$_mm3_mv" = "$_mm3_vv" ] || return 1
+	printf '%s\n' "$_mm3_mv" | LC_ALL=C grep -Eq '^[0-9][A-Za-z0-9._:+~-]*$' || return 1
+	_mm3_cmp=$("$_mm3_vc" "$_mm3_mv" '1:26.3.0_devel.20261025.231095.7c86130d26c-1') || return 1
+	case $_mm3_cmp in 0|1) ;; *) return 1 ;; esac
+	for _mm3_role in \
+		'mesa-aurora:/usr/lib/libEGL_mesa.so.0' \
+		'mesa-aurora:/usr/lib/libgbm.so.1' \
+		'mesa-aurora:/usr/lib/dri/asahi_dri.so' \
+		'vulkan-aurora:/usr/lib/libvulkan_asahi.so' \
+		'vulkan-aurora:/usr/share/vulkan/icd.d/asahi_icd.aarch64.json'; do
+		_mm3_owned=${_mm3_role%%:*}
+		_mm3_real=$(readlink -f "$1${_mm3_role#*:}" 2>/dev/null) || return 1
+		[ -f "$_mm3_real" ] && [ -r "$_mm3_real" ] || return 1
+		case $_mm3_real in "$1"/usr/lib/*|"$1"/usr/share/vulkan/icd.d/*) ;; *) return 1 ;; esac
+		_mm3_owner=$("$_mm3_pm" --root "$_mm3_pkgroot" -Qqo -- "$_mm3_real" 2>/dev/null) || return 1
+		[ "$_mm3_owner" = "$_mm3_owned" ] || return 1
+	done
+}
+
+# Manual opt-out or the package-gated native default may keep system Mesa. Prints
 # one detail line and returns 0 only when every check below passes. A helper
 # exit of 0 is not enough on its own. Does not write an attempt or touch a
-# marker. mesa_m3=off is not a file opt-out.
+# marker. mesa_m3=off is not a file opt-out. $2 is default or manual.
 _mm3_system_admit() {
 	case ${XDG_CURRENT_DESKTOP:-} in Hyprland|hyprland) ;; *) return 1 ;; esac
 	_mm3_cmdline=$(cat "$1/proc/cmdline" 2>/dev/null) || return 1
 	case " $_mm3_cmdline " in
 	*" mesa_m3=off "*|*" nomodeset "*) return 1 ;;
 	esac
-	if [ ! -e "$1/etc/mesa-m3/disable" ] &&
-		[ ! -e "$1${XDG_CONFIG_HOME:-$HOME/.config}/mesa-m3/disable" ]; then
-		return 1
-	fi
+	case ${2:-manual} in
+	default)
+		# Preserve file opt-outs on the existing manual route, and never
+		# override an explicitly selected legacy/experimental profile.
+		[ ! -e "$1/etc/mesa-m3/disable" ] &&
+			[ ! -e "$1${XDG_CONFIG_HOME:-$HOME/.config}/mesa-m3/disable" ] || return 1
+		[ ! -e "$1/etc/mesa-m3/t8122-profile" ] || return 1 ;;
+	manual)
+		[ -e "$1/etc/mesa-m3/disable" ] ||
+			[ -e "$1${XDG_CONFIG_HOME:-$HOME/.config}/mesa-m3/disable" ] || return 1 ;;
+	*) return 1 ;;
+	esac
 	_mm3_dt=$(tr '\0' '\n' 2>/dev/null < "$1/proc/device-tree/compatible")
 	_mm3_soc=$(_mm3_soc_of "$1")
 	_mm3_chip=
 	_mm3_identity=$(printf '%s\n' "$_mm3_dt" | grep -E '^apple,j')
 	_mm3_socs=$(printf '%s\n' "$_mm3_dt" | grep -E '^apple,t')
 	case "$_mm3_soc:$_mm3_identity:$_mm3_socs" in
 	t8122:apple,j613:apple,t8122) _mm3_chip=t8122 ;;
+	t8122:apple,j615:apple,t8122) _mm3_chip=t8122 ;;
 	t6030:apple,j516s:apple,t6030) _mm3_chip=t6030 ;;
 	*) return 1 ;;
 	esac
+	if [ "${2:-manual}" = default ]; then
+		_mm3_native_packages "$1" || return 1
+	fi
 	# Exactly one render node, and it is this SoC's asahi GPU, and this user
 	# can open it. An any-node match is not enough.
 	_mm3_nodes=0
@@ -457,8 +507,8 @@ _mm3_system_admit() {
 _mm3_system_admit_bounded() {
 	_mm3_self=${1:-}/opt/mesa-m3/libexec/mesa-m3-session-env
 	[ -r "$_mm3_self" ] || return 1
-	timeout -k 2 20 sh -c 'MESA_M3_SESSION_ENV_NO_RUN=1 . "$1" && _mm3_p=$3 && _mm3_system_admit "$2"' \
-		sh "$_mm3_self" "${1:-}" "$_mm3_p"
+	timeout -k 2 20 sh -c 'MESA_M3_SESSION_ENV_NO_RUN=1 . "$1" && _mm3_p=$3 && _mm3_system_admit "$2" "$4"' \
+		sh "$_mm3_self" "${1:-}" "$_mm3_p" "${2:-manual}"
 }
 
 # _mm3_state ROOT DECISION REASON DETAIL FALLBACK: write the state file and the journal
@@ -524,8 +574,14 @@ _mm3_attempt() {
 # root directory for tests ("" in sessions).
 mesa_m3_session_env() {
 	_mm3_init "${1:-}"
-	_mm3_decision=$(mesa_m3_gate "${1:-}")
-	_mm3_on=$?
+	_mm3_sys=$(_mm3_system_admit_bounded "${1:-}" default)
+	if [ "$?" -eq 0 ]; then
+		_mm3_decision="native-default $_mm3_sys"
+		_mm3_on=1
+	else
+		_mm3_decision=$(mesa_m3_gate "${1:-}")
+		_mm3_on=$?
+	fi
 	# One random id per run, in the state file and (except where this is
 	# neither a T6030 nor a T8122) in the session environment: the checker
 	# binds the two.
@@ -561,26 +617,26 @@ mesa_m3_session_env() {
 		_mm3_state "${1:-}" active "${_mm3_decision%% *}" "${_mm3_decision#* }" none
 		_mm3_attempt "${1:-}"
 	else
-		# Never the system Mesa on an M3 render node it can open (Hyprland
-		# would stop at start), except where this session's own setup chose,
-		# or a file opt-out whose system-Mesa handoff passed.
+		# Keep the legacy fallback unless the native default/manual handoff
+		# passed, or this session's own provider setup decides instead.
 		_mm3_fb=none
 		_mm3_detail=${_mm3_decision#* }
 		_mm3_admitted=0
-		if [ "${_mm3_decision%% *}" = opt-out ]; then
+		if [ "${_mm3_decision%% *}" = native-default ]; then
+			_mm3_admitted=1
+		elif [ "${_mm3_decision%% *}" = opt-out ]; then
 			_mm3_sys=$(_mm3_system_admit_bounded "${1:-}")
 			if [ "$?" -eq 0 ]; then
 				_mm3_admitted=1
 				_mm3_detail="$_mm3_detail; $_mm3_sys"
-				# Only the pair this hook itself exports. Anything else in the
-				# environment, including a user's own LIBGL_ALWAYS_SOFTWARE
-				# without this marker, stays.
-				if [ "${LIBGL_ALWAYS_SOFTWARE:-}" = 1 ] && [ "${MESA_M3_FALLBACK:-}" = software ]; then
-					unset LIBGL_ALWAYS_SOFTWARE
-					unset MESA_M3_FALLBACK
-				fi
 			fi
 		fi
+		# Only clear the pair this hook itself exports; preserve a user's
+		# separate software preference and every other provider selector.
+		if [ "$_mm3_admitted" -eq 1 ] && [ "${LIBGL_ALWAYS_SOFTWARE:-}" = 1 ] && [ "${MESA_M3_FALLBACK:-}" = software ]; then
+			unset LIBGL_ALWAYS_SOFTWARE
+			unset MESA_M3_FALLBACK
+		fi
 		if [ "$_mm3_admitted" -eq 0 ] && [ "${_mm3_decision%% *}" != user-setup ] && _mm3_node_open "${1:-}"; then
 			export LIBGL_ALWAYS_SOFTWARE=1
 			export MESA_M3_FALLBACK=software
@@ -595,11 +651,12 @@ if [ -z "${MESA_M3_SESSION_ENV_NO_RUN:-}" ]; then
 	unset -f mesa_m3_gate mesa_m3_session_env _mm3_init _mm3_state _mm3_node_open _mm3_attempt \
 		_mm3_soc_of _mm3_25g83_board _mm3_native_display _mm3_kernel_log \
 		_mm3_legacy_attempt_clear _mm3_system_admit _mm3_system_admit_bounded
+	unset -f _mm3_native_packages
 fi
 unset _mm3_root _mm3_p _mm3_nodes _mm3_node _mm3_n _mm3_drv _mm3_dcp _mm3_c _mm3_dev _mm3_f _mm3_v \
 	_mm3_val _mm3_ifs _mm3_d _mm3_out _mm3_rc _mm3_decision _mm3_on \
 	_mm3_so _mm3_uid _mm3_sid _mm3_inv _mm3_ver _mm3_boot _mm3_cr _mm3_nl \
 	_mm3_body _mm3_kv _mm3_dir _mm3_tmp _mm3_fb _mm3_run _mm3_att _mm3_ok _mm3_faults _mm3_ign _mm3_igd \
 	_mm3_soc _mm3_name _mm3_dt _mm3_base _mm3_profile _mm3_requested _mm3_files _mm3_gate_ifs _mm3_board _mm3_note \
 	_mm3_klog _mm3_sys _mm3_admitted _mm3_detail _mm3_helper _mm3_chip _mm3_identity _mm3_socs _mm3_cmdline \
-	_mm3_self
+	_mm3_self _mm3_pm _mm3_vc _mm3_pkgroot _mm3_mv _mm3_vv _mm3_cmp _mm3_role _mm3_owned _mm3_real _mm3_owner
@@ -18,9 +18,8 @@
 static bool
 board_compat_matches(const char *bytes, size_t length, const char *soc)
 {
-   const char *board = !strcmp(soc, "t8122") ? "apple,j613" :
-                       !strcmp(soc, "t6030") ? "apple,j516s" : NULL;
-   if (!board || !length || bytes[length - 1] != '\0')
+   if ((strcmp(soc, "t8122") && strcmp(soc, "t6030")) ||
+       !length || bytes[length - 1] != '\0')
       return false;
    unsigned boards = 0, socs = 0;
    size_t offset = 0;
@@ -31,7 +30,10 @@ board_compat_matches(const char *bytes, size_t length, const char *soc)
          return false;
       const char *value = bytes + offset;
       if (!strncmp(value, "apple,j", 7)) {
-         if (strcmp(value, board))
+         bool matches = !strcmp(soc, "t8122") ?
+            (!strcmp(value, "apple,j613") || !strcmp(value, "apple,j615")) :
+            !strcmp(value, "apple,j516s");
+         if (!matches)
             return false;
          boards++;
       } else if (!strncmp(value, "apple,t", 7)) {

@@ -5,8 +5,23 @@ With native Mesa installed in `/usr`, the legacy file opt-out still forced
 system driver worked. The legacy package owns this hook, so the native Mesa
 package must not overwrite it or add an unconditional late unset.
 
-This change allows a file opt-out on J613/T8122 and J516S/T6030 to leave system
-Mesa selected. It requires one accessible Asahi render node, the matching
+The proposed default selects native system Mesa on exact J613/T8122,
+J615/T8122 and J516S/T6030 identities when matching `mesa-aurora` and
+`vulkan-aurora` packages are installed at or above
+`1:26.3.0_devel.20261025.231095.7c86130d26c-1`. The resolved EGL/GBM/Asahi and
+Vulkan implementation files must be owned by those packages under `/usr`.
+This is a package capability floor, not proof of hardware qualification.
+J615 final-package/login/rendering qualification remains required before merge.
+No per-build hash or duplicate firmware-version allowlist is introduced: the
+bound native kernel admits firmware/resources, and native Mesa rejects an
+incompatible chip/topology/USC/HAL/features contract before context creation.
+In particular this default does not convert the separate HAL200 legacy profile
+into the native driver's legacy-HAL contract.
+
+An explicitly selected `/etc/mesa-m3/t8122-profile`, user provider/software
+override or recovery command-line option prevents the automatic selection.
+The existing file opt-out remains a separate manual route without the new
+package floor. Both routes require one accessible Asahi render node, the matching
 native display, a readable healthy kernel journal, no unmatched same-boot
 legacy login attempt, and no conflicting environment or later user settings.
 A bounded helper then opens the exact EGL device using only `/usr` libraries
@@ -25,20 +40,25 @@ returns within a 20-second timeout, so a stalled journal, home directory or
 scanner refuses instead of holding the login. The helper keeps its own
 5-second timeout.
 
-A failed check keeps the existing software fallback. `mesa_m3=off` and
-`nomodeset` remain recovery choices. Other boards, including J615, remain
-outside this system handoff. Explicit legacy profile selection is unchanged.
+A failed default check continues the existing legacy/fallback decision;
+a failed manual handoff keeps its software fallback. `mesa_m3=off` and
+`nomodeset` remain software recovery choices. Other or ambiguous board/SoC
+identities remain outside this system handoff. Explicit legacy profile selection
+is unchanged.
 No opt-in flags, attempt records or success markers are added or removed.
 Only the exact software-fallback pair previously exported by this hook can
 be cleared. The state remains `inactive`, `reason=opt-out`, `fallback=none`
-when system Mesa admission succeeds.
+when manual system Mesa admission succeeds. The automatic route records
+`inactive`, `reason=native-default`, `fallback=none`, without creating a file
+opt-out or adding legacy opt-in environment variables.
 
 The helper proves only that the system EGL device and a context open. It does
 not allocate GBM buffers, render or present. A system-Mesa login that passes
 admission and then fails later is not recorded: this path writes no attempt,
 so the legacy success-marker check cannot see it, and the next login is
-admitted again. Recover with `mesa_m3=off` on the kernel command line or by
-removing the opt-out file. Separate system-Mesa attempt and success markers
+admitted again. Recover with `mesa_m3=off`/`nomodeset` on the kernel command
+line or an explicit user software/provider choice. Removing a manual opt-out
+file does not disable an otherwise admitted native default. Separate system-Mesa attempt and success markers
 would make that recovery automatic.
 
 Run the host checks from this directory (a writable TMPDIR may be needed):
@@ -59,6 +79,8 @@ desktop user without opt-in variables and returned
 or reboot. This is device/context admission, not a packaged login test,
 rendering qualification, CTS result or support claim for other boards.
 
+The host tests use fake package-query tools and a stub EGL helper. They cannot
+qualify firmware, real package signatures, graphics, rendering or a login.
 Before an image cutover, build the updated legacy package and verify a fresh
 login alongside the actual pinned Omacom Mesa packages. Existing legacy users
 and unqualified profiles must retain their recovery path; clean system-Mesa