DE25: mirror the DE10 firmware set via a shared image-common fragment (ADR 0029 D11/D12)

.github/actions/buildroot-build/action.yml

@@ -331,18 +331,20 @@ runs:
 
     # 2. dl/ — every package source tarball. Lives at repo root (survives
     # `make clean`) — NEVER move it under output/. Keyed on the full
-    # DE10-Nano fragment stack (the three files configs/fragments/stacks.mk
+    # DE10-Nano fragment stack (the four files configs/fragments/stacks.mk
     # lists for DE10NANO_FRAGMENTS — hashFiles() cannot read stacks.mk, so
-    # they are spelled out here; keep the two in step); restore-keys falls
-    # back to the version alone so an imperfect match still hydrates what
-    # didn't change. See docs/ci.md#dl-cache.
+    # they are spelled out here; keep the two in step, which
+    # scripts/check-config-fragments.sh (e) asserts by comparing this list
+    # with the stack); restore-keys falls back to the version alone so an
+    # imperfect match still hydrates what didn't change. See
+    # docs/ci.md#dl-cache.
     - name: Restore Buildroot dl/ download cache
       id: dl-cache
       if: env.VARIANT == 'main'
       uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: dl/
-        key: br-dl-${{ env.BUILDROOT_VERSION }}-${{ hashFiles('configs/fragments/common.fragment', 'configs/fragments/de10nano.fragment', 'configs/fragments/de10nano-image.fragment') }}
+        key: br-dl-${{ env.BUILDROOT_VERSION }}-${{ hashFiles('configs/fragments/common.fragment', 'configs/fragments/de10nano.fragment', 'configs/fragments/image-common.fragment', 'configs/fragments/de10nano-image.fragment') }}
         restore-keys: |
           br-dl-${{ env.BUILDROOT_VERSION }}-
 

TASKS.md

@@ -708,7 +708,9 @@ Exit criterion: hardware matrix (§11) green (P3.13).
   **Result: module-autoload half already done pre-task (kmod+depmod xz support,
   modules.dep/modules.alias populated — see the P3.3 (core) commit). This pass covers only
   `/lib/firmware` population.** `configs/mister_de10nano_defconfig` (now
-  `configs/fragments/de10nano-image.fragment`, §5.28 of `docs/buildroot-config.md`) gained
+  `configs/fragments/image-common.fragment`, §12.1 of `docs/buildroot-config.md` —
+  it was `de10nano-image.fragment` / §5.28 until the DE25 image adopted the same
+  set on 2026-09-03) gained
   `BR2_PACKAGE_LINUX_FIRMWARE` + 9 sub-options (`MEDIATEK_MT7601U/MT7610E/MT7650/MT76X2E`,
   `RALINK_RT2XX`, `RTL_81XX/RTL_87XX/RTL_87XX_BT/RTL_88XX_BT`), `BR2_PACKAGE_WIRELESS_REGDB`
   (a separate package from linux-firmware for `regulatory.db`/`.p7s`), and

configs/fragments/de10nano-image.fragment

@@ -300,40 +300,8 @@ BR2_PACKAGE_DUALSENSECTL=y
 # --- ltunify: Logitech Unifying pairing (§5.27, docs/logitech-pairing.md) ---
 BR2_PACKAGE_LTUNIFY=y
 
-# --- /lib/firmware population (P3.3, §5.28, docs/firmware-parity.md) ---
-# WARNING: changing linux-firmware SUB-options on an incremental build installs
-# nothing (Buildroot stamping) — `make linux-firmware-dirclean` first.
-BR2_PACKAGE_LINUX_FIRMWARE=y
-BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7601U=y
-BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7610E=y
-BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7650=y
-BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT76X2E=y
-BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7921=y
-BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7925=y
-BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT2XX=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_81XX=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_87XX=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_87XX_BT=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_88XX_BT=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW88=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW89=y
-BR2_PACKAGE_LINUX_FIRMWARE_ATHEROS_9271=y
-BR2_PACKAGE_LINUX_FIRMWARE_ATHEROS_7010=y
-BR2_PACKAGE_LINUX_FIRMWARE_ATHEROS_9170=y
-BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7921_BT=y
-BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7922_BT=y
-BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7925_BT=y
-BR2_PACKAGE_LINUX_FIRMWARE_QUALCOMM_6174A_BT=y
-BR2_PACKAGE_LINUX_FIRMWARE_ATHEROS_6004=y
-BR2_PACKAGE_LINUX_FIRMWARE_REDPINE_RS9113=y
-BR2_PACKAGE_LINUX_FIRMWARE_REDPINE_RS9116=y
-BR2_PACKAGE_LINUX_FIRMWARE_AR3011=y
-BR2_PACKAGE_LINUX_FIRMWARE_AR3012_USB=y
-BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XX=y
-BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XXX=y
-BR2_PACKAGE_WIRELESS_REGDB=y
-BR2_PACKAGE_LINUX_FIRMWARE_EXTRA=y
-BR2_PACKAGE_BCM20702_FIRMWARE=y
+# --- /lib/firmware population: MOVED to image-common.fragment (§12.1) — the
+# blob set is shared by BOTH boards' image stacks (§10, §12) — a note, no config ---
 
 # --- explicitly NOT carried forward: manifest §5 Drop list (§5.29) — a note, no config ---
 

configs/fragments/de25nano.fragment

@@ -2,10 +2,15 @@
 # (Intel/Altera Agilex 5, HPS = 2x Cortex-A76 + 2x Cortex-A55, aarch64).
 # NO MiSTer packages, NO DE10 packages — that is the accepted release scope
 # (ADR 0027 Decision 6, ADR 0029, docs/de25-nano-tasks.md D2.7), not a gap.
-# Layered on common only (configs/fragments/stacks.mk, DE25NANO_FRAGMENTS);
-# no BR2_ symbol here is shared with the DE10 stacks except through that common
-# layer. Two FILES are shared by path — the kernel-tarball hash registry (§6.3)
-# and the MiSTer kernel-config fragment (§6.5) — and each says so at its line.
+# The ONE package set this board shares with the DE10 image is the /lib/firmware
+# blob set, and it is NOT listed here: the stack is `common de25nano
+# image-common` (configs/fragments/stacks.mk, DE25NANO_FRAGMENTS) and
+# image-common.fragment carries that selection once for both boards (owner
+# decision 2026-09-03, docs/buildroot-config.md §12; the shared kernel fragment
+# below already builds the Wi-Fi/Bluetooth drivers that ask for those blobs).
+# No BR2_ symbol here is shared with the DE10 stacks except through those two
+# shared layers. Two FILES are shared by path — the kernel-tarball hash registry
+# (§6.3) and the MiSTer kernel-config fragment (§6.5) — each says so at its line.
 # Rationale for every line: docs/buildroot-config.md §6.
 
 # --- Architecture & toolchain (docs/buildroot-config.md §6.2) ---
@@ -50,6 +55,9 @@ BR2_LINUX_KERNEL_IMAGE=y
 BR2_LINUX_KERNEL_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_MISTER_PATH)/board/mister/de25nano/socfpga_agilex5_de25nano.dts"
 
 # --- Root filesystem: plain ext4, 256 MiB (docs/buildroot-config.md §6.6) ---
+# MEASURED 2026-09-03, with image-common's ~52 MiB of firmware installed:
+# 85.6 MiB used of 256 MiB (33%), 170 MiB free. No bump needed; the headroom is
+# the point of the number, so it is not trimmed to fit either.
 BR2_TARGET_ROOTFS_EXT2=y
 BR2_TARGET_ROOTFS_EXT2_4=y
 BR2_TARGET_ROOTFS_EXT2_LABEL="rootfs"
@@ -65,7 +73,9 @@ BR2_TARGET_GENERIC_ISSUE="Welcome to MiSTer DE25-Nano (developer OS)"
 # Empty = passwordless root; on this board the only way in (no SSH keys yet).
 BR2_TARGET_GENERIC_ROOT_PASSWD=""
 
-# --- Packages: none, deliberately (docs/buildroot-config.md §6.8) ---
+# --- Packages: none beyond the shared firmware set (docs/buildroot-config.md §6.8) ---
+# The /lib/firmware blobs come from image-common.fragment (§12); nothing else
+# is enabled here, and adding something needs a task that authorises it.
 # WARNING: the day BR2_PACKAGE_OPENSSH=y is added here it must be added
 # TOGETHER WITH `# BR2_PACKAGE_OPENSSH_SANDBOX is not set` — this board's
 # linux.config has no CONFIG_SECCOMP, and openssh's sandbox is `default y`,

configs/fragments/golden.sha256

@@ -6,5 +6,5 @@
 # <BUILDROOT_VERSION> <stack> <sha256>
 2026.05.2 de10nano 3cb8e3d9b32d701c4e3eefa1b9993da9b76a73a29a3b29f57924c10b807138a1
 2026.05.2 de10nano-kernel 5b372abe43c46c4eb5f3c88d51e48ff2eb6fa713b3c02f0f337c39d0f111dc69
-2026.05.2 de25nano 2adb6b4029bee4467053403fdcf290042ccd2b554cc126de9a2f7a155b433b28
+2026.05.2 de25nano 714728e0bd12e3fb6f86a0b932c204a1acae642a9aba3d0770501bc6b3d7952a
 2026.05.2 rt e34a522a56eb088ac84b1e6db7350a22f12293d0d84086dbf1f405f68a58b7e5

configs/fragments/image-common.fragment

@@ -0,0 +1,61 @@
+# image-common.fragment — the package set every board's SHIPPED IMAGE gets,
+# whatever its architecture. Arch-neutral by construction: nothing here may
+# name a CPU, an ABI, a board directory, a MiSTer binary or an out-of-tree
+# driver for hardware only one board can host.
+#
+# In the IMAGE stack of every board (configs/fragments/stacks.mk:
+# DE10NANO_FRAGMENTS and DE25NANO_FRAGMENTS) and in the kernel-only stack of
+# none of them — that is the whole point of the fragment, and the reason it is
+# not `common`: `common` IS in the kernel-only stack, so a package line there
+# would spend a ~557 MiB fetch and ~52 MiB of install, on every kernel leg, on
+# blobs that land in a rootfs.tar which ships nothing but modules and is then
+# thrown away — and would move that stack's dl-cache key, which hashes
+# common.fragment (docs/buildroot-config.md §10, its rule 6 and the firmware
+# row; the toolchain fingerprint is the one key a BR2_PACKAGE_ line cannot
+# move — it denies that prefix). It is equally not per-board: parity between
+# the boards is exactly what this fragment makes structural, not remembered.
+#
+# THIS IS THE HOME FOR THE SHARED PACKAGE SET AS THE DE25 GROWS. A package
+# both images want moves de10nano-image.fragment -> here, in a commit that
+# shows the de10nano golden hash did NOT move (the resolved config is the
+# same, only differently filed) and the de25nano one did. What must NOT come
+# here: anything DE10-specific, and anything the DE25's bare-developer-OS
+# scope has not taken (ADR 0027 Decision 6 / ADR 0029 — §10 rule 5 still
+# applies; an owner decision per package, not a refactor's side effect).
+#
+# Rationale for every line: docs/buildroot-config.md §12.
+
+# --- /lib/firmware population (P3.3, §12.1, docs/firmware-parity.md) ---
+# WARNING: changing linux-firmware SUB-options on an incremental build installs
+# nothing (Buildroot stamping) — `make linux-firmware-dirclean` first.
+BR2_PACKAGE_LINUX_FIRMWARE=y
+BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7601U=y
+BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7610E=y
+BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7650=y
+BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT76X2E=y
+BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7921=y
+BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7925=y
+BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT2XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_81XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_87XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_87XX_BT=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_88XX_BT=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW88=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW89=y
+BR2_PACKAGE_LINUX_FIRMWARE_ATHEROS_9271=y
+BR2_PACKAGE_LINUX_FIRMWARE_ATHEROS_7010=y
+BR2_PACKAGE_LINUX_FIRMWARE_ATHEROS_9170=y
+BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7921_BT=y
+BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7922_BT=y
+BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7925_BT=y
+BR2_PACKAGE_LINUX_FIRMWARE_QUALCOMM_6174A_BT=y
+BR2_PACKAGE_LINUX_FIRMWARE_ATHEROS_6004=y
+BR2_PACKAGE_LINUX_FIRMWARE_REDPINE_RS9113=y
+BR2_PACKAGE_LINUX_FIRMWARE_REDPINE_RS9116=y
+BR2_PACKAGE_LINUX_FIRMWARE_AR3011=y
+BR2_PACKAGE_LINUX_FIRMWARE_AR3012_USB=y
+BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XX=y
+BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XXX=y
+BR2_PACKAGE_WIRELESS_REGDB=y
+BR2_PACKAGE_LINUX_FIRMWARE_EXTRA=y
+BR2_PACKAGE_BCM20702_FIRMWARE=y

configs/fragments/stacks.mk

@@ -12,6 +12,15 @@
 # CONSTRUCTION — that is what keeps the kernel-only base (used by `make rt`
 # and every CI kernel leg) in lockstep with the shipped image without a
 # mirrored copy. scripts/check-kernel-defconfig-sync.sh asserts this.
-DE10NANO_FRAGMENTS        := common de10nano de10nano-image
+#
+# `image-common` is the second sharing axis, at right angles to the first: it
+# is in the IMAGE stack of every board and in the kernel-only stack of NONE,
+# so a package both images want is selected once instead of mirrored per
+# board — and the kernel-only base keeps its no-packages shape (§10 rule 4:
+# `common` is in the kernel-only stack's fingerprint text, `image-common` is
+# not). Merge order within a stack is free here: no symbol may be defined
+# twice in one stack (scripts/check-config-fragments.sh (a)), so the board
+# layer and the shared image layer never race.
+DE10NANO_FRAGMENTS        := common de10nano image-common de10nano-image
 DE10NANO_KERNEL_FRAGMENTS := common de10nano kernel-only
-DE25NANO_FRAGMENTS        := common de25nano
+DE25NANO_FRAGMENTS        := common de25nano image-common