diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml
index a189ea1fba..4ddc6bc9ca 100644
--- a/.github/workflows/build-pr.yml
+++ b/.github/workflows/build-pr.yml
@@ -43,6 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.list.outputs.matrix }}
+      runners: ${{ steps.list.outputs.runners }}
       count: ${{ steps.gate.outputs.count }}
       trusted: ${{ steps.gate.outputs.trusted }}
       vouch_status: ${{ steps.vouch.outputs.status }}
@@ -133,8 +134,18 @@ jobs:
               { echo "Reused existing build artifacts (${#reused[@]}):"; printf -- '- %s\n' "${reused[@]}"; } >> "$GITHUB_STEP_SUMMARY"
             fi
           fi
-          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
-          echo "planned=$(jq '.include | length' <<<"$matrix")" >> "$GITHUB_OUTPUT"
+          # The runner of each entry moves to a map: GitHub names a matrix job
+          # after its values, and a runner list in every check name helps
+          # nobody. A base whose build-matrix predates runners has none.
+          runners=$(jq -c 'reduce (.include[] | select((.runner // "") != "")) as $e ({}; .[$e.package][$e.arch] = ($e.runner | fromjson))' <<<"$matrix")
+          matrix=$(jq -c '{include: [.include[] | del(.runner)]}' <<<"$matrix")
+          {
+            echo "matrix=$matrix"
+            echo "runners=$runners"
+            # The DKMS check needs every package that would publish, reused ones too.
+            echo "reused=$(printf '%s\n' "${reused[@]:-}" | jq -Rsc 'split("\n") | map(select(length > 0))')"
+            echo "planned=$(jq '.include | length' <<<"$matrix")"
+          } >> "$GITHUB_OUTPUT"
           jq -r '.include[] | "\(.package) \(.arch) -> \(.channels)"' <<<"$matrix"
           # A PR whose diff against its base is empty changes nothing: its
           # content already landed some other way (a sync PR beat it, or a
@@ -175,6 +186,28 @@ jobs:
             fi
           fi
 
+      # What this build ships, for the DKMS check (dkms-check.yml). It runs
+      # after this run completes, from master's copy, and reads this as data:
+      # whether the build ran, its matrix, and the artifacts it reused.
+      - name: Record what the DKMS check reads
+        if: github.event_name == 'pull_request'
+        env:
+          MATRIX: ${{ steps.list.outputs.matrix }}
+          REUSED: ${{ steps.list.outputs.reused }}
+          TRUSTED: ${{ steps.gate.outputs.trusted }}
+        run: |
+          jq -n --argjson matrix "$MATRIX" --argjson reused "$REUSED" --arg trusted "$TRUSTED" \
+            '{trusted: ($trusted == "true"), matrix: $matrix, reused: $reused}' >dkms-request.json
+          cat dkms-request.json
+      - if: github.event_name == 'pull_request'
+        uses: actions/upload-artifact@v4
+        with:
+          name: dkms-request
+          path: dkms-request.json
+          if-no-files-found: error
+          retention-days: 7
+          overwrite: true
+
   build:
     needs: changes
     if: needs.changes.outputs.count != '0'
@@ -184,12 +217,14 @@ jobs:
     # build it natively in 11 minutes, and linux-aurora in 30 (72 under QEMU).
     # An aarch64 kernel goes to Namespace's Apple-backed runner instead:
     # linux-omarchy-n1x took 1h45m on the 4 vCPU, and takes 24 minutes there. bin/build-matrix names the runner for each
-    # entry (package_runner); a base branch whose build-matrix predates that
-    # gives none, and gets the runners named here.
-    # The name GitHub made from the matrix before it carried the runner, so
-    # the checks on a pull request keep the names they had.
-    name: build (${{ matrix.package }}, ${{ matrix.arch }}, ${{ matrix.channels }}, ${{ matrix.publish_arches }})
-    runs-on: ${{ matrix.runner && fromJSON(matrix.runner) || (matrix.arch == 'aarch64' && 'ubuntu-24.04-arm' || fromJSON('["self-hosted","omarchy-builder"]')) }}
+    # entry (package_runner), and the changes job moves it to the runners
+    # map; a base branch whose build-matrix predates that gives none, and gets
+    # the runners named here.
+    # No name: GitHub's own, "build (package, arch, channels, publish_arches)",
+    # is the one these checks always had, and a build that is skipped shows as
+    # plain "build". A name with matrix expressions shows them unevaluated
+    # then, because GitHub evaluates nothing for a skipped job.
+    runs-on: ${{ fromJSON(needs.changes.outputs.runners || '{}')[matrix.package][matrix.arch] || (matrix.arch == 'aarch64' && 'ubuntu-24.04-arm' || fromJSON('["self-hosted","omarchy-builder"]')) }}
     timeout-minutes: 180
     strategy:
       fail-fast: false
diff --git a/.github/workflows/dkms-check.yml b/.github/workflows/dkms-check.yml
new file mode 100644
index 0000000000..d7c53a1219
--- /dev/null
+++ b/.github/workflows/dkms-check.yml
@@ -0,0 +1,254 @@
+name: DKMS check
+
+# Builds DKMS modules against kernel headers (dkms-matrix.yml, bin/check-dkms):
+#   - after every pull request build ("Build changed packages"), on what the
+#     build would publish: a new kernel against every module, Arch's included,
+#     and a new module against every kernel. The pull request gets one check,
+#     "DKMS check: 41/45 passed", whose summary has a row per kernel and module
+#     and links this run, where every leg is its own job;
+#   - daily, on every pair on edge that has not built at its versions yet:
+#     Arch updates the DKMS packages Omarchy installs from it (ci/dkms-packages
+#     repo=) on its own schedule;
+#   - by hand, for a whole channel, or for a channel as a promotion into it
+#     would leave it (rc with what differs on edge moved in):
+#       gh workflow run dkms-check.yml -R omacom/omarchy-pkgs -f channel=stable
+#       gh workflow run dkms-check.yml -R omacom/omarchy-pkgs -f channel=rc -f from=edge
+#   - by hand for a pull request, the same path as after its build:
+#       gh workflow run dkms-check.yml -R omacom/omarchy-pkgs -f pr=1250
+#     From a branch (--ref) it runs that branch's check, which is how a change
+#     to the check itself is proven before it merges; -f all=true checks every
+#     pair on the channel with the pull request's packages in place.
+# promote.yml calls dkms-matrix.yml itself, on what a promotion moves.
+#
+# Why workflow_run and not the pull request's own workflow: every job of a
+# pull_request run is a check on the pull request, about 45 of them for a
+# kernel. This run's jobs attach to master's head instead, and the pull
+# request gets the one check this workflow writes through the Checks API.
+#
+# workflow_run runs master's copy of this file with a token that could write,
+# so: the only jobs that may write (checks: write, to open and close that one
+# check) never check out the repository or download anything; they pass the
+# event's commit and run ids and the matrix's verdict to the API through jq,
+# as data. The matrix itself is read-only and runs master's tooling; the pull
+# request's build is data until a leg unpacks it in a throwaway container.
+
+on:
+  workflow_run:
+    workflows: [Build changed packages]
+    types: [completed]
+  schedule:
+    - cron: "37 5 * * *"
+  workflow_dispatch:
+    inputs:
+      channel:
+        description: Channel whose kernels and DKMS packages to check
+        type: choice
+        options: [edge, rc, stable]
+        default: edge
+      from:
+        description: "A promotion's source: check the channel with what differs there moved in (empty: everything)"
+        required: false
+        default: ""
+      from_repos:
+        description: Only the DKMS packages from Arch's repositories, against every kernel
+        type: boolean
+        default: false
+      pr:
+        description: "A pull request: check what its newest green build ships, and report it there as one check"
+        required: false
+        default: ""
+      head_sha:
+        description: "The commit whose build to check (default: the pull request's head)"
+        required: false
+        default: ""
+      all:
+        description: With pr or head_sha, every pair on the channel, the build's packages in place
+        type: boolean
+        default: false
+
+permissions: {}
+
+# One run per commit at a time: a newer build of the same commit (a label
+# starts one) replaces the check in flight, which closes as cancelled. Keyed by
+# commit, so a build of an older commit that finishes late, or one this
+# workflow ignores (failed, cancelled, not a pull request's), never cancels the
+# check of the pull request's head.
+concurrency:
+  group: >-
+    dkms-check-${{ github.event_name == 'workflow_run'
+      && (github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
+        && github.event.workflow_run.path == '.github/workflows/build-pr.yml'
+        && format('sha-{0}', github.event.workflow_run.head_sha) || format('ignored-{0}', github.run_id))
+      || ((inputs.pr || inputs.head_sha) && format('pr-{0}-{1}', inputs.pr, inputs.head_sha))
+      || format('{0}-{1}-{2}-{3}', github.event_name, github.ref, inputs.channel || 'edge', inputs.from || 'all') }}
+  cancel-in-progress: ${{ (github.event_name == 'workflow_run' || inputs.pr || inputs.head_sha) && true || false }}
+
+jobs:
+  # A pull request's build: which commit and run, and the check, opened as in
+  # progress so the pull request shows it while the legs build. A commit the
+  # pull request has moved past gets no check. The build's dkms-request is
+  # only as good as the build-pr.yml that wrote it, and a fork's pull request
+  # runs its own copy: a build from a fork whose build-pr.yml differs from
+  # its merge base's is refused, never checked. Any API error fails this job
+  # before a check opens, so it fails closed.
+  target:
+    name: open the check
+    if: >-
+      (github.event_name == 'workflow_run' && github.event.workflow_run.event == 'pull_request'
+        && github.event.workflow_run.conclusion == 'success'
+        && github.event.workflow_run.path == '.github/workflows/build-pr.yml')
+      || (github.event_name == 'workflow_dispatch' && (inputs.pr != '' || inputs.head_sha != ''))
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      checks: write
+      actions: read
+      pull-requests: read
+    outputs:
+      head_sha: ${{ steps.open.outputs.head_sha }}
+      build_run: ${{ steps.open.outputs.build_run }}
+      check_run: ${{ steps.open.outputs.check_run }}
+      refused: ${{ steps.open.outputs.refused }}
+    steps:
+      # No checkout: nothing from the repository, let alone a pull request,
+      # runs next to this token.
+      - name: Find the build and open its check
+        id: open
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT_SHA: ${{ github.event.workflow_run.head_sha }}
+          EVENT_RUN: ${{ github.event.workflow_run.id }}
+          HEAD_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          PR: ${{ inputs.pr }}
+          SHA: ${{ inputs.head_sha }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          pr=$PR refused=""
+          if [[ -n $EVENT_RUN ]]; then
+            sha=$EVENT_SHA run=$EVENT_RUN
+            # The event names no pull request for a fork's; find it by its
+            # head. One that has moved on to a newer commit gets no check.
+            pr=$(gh api -X GET "repos/$GITHUB_REPOSITORY/pulls" -f state=open -f head="$HEAD_OWNER:$HEAD_BRANCH" |
+              jq -r --arg sha "$sha" '[.[] | select(.head.sha == $sha)][0].number // empty')
+            if [[ -z $pr ]]; then
+              echo "no open pull request has $sha as its head; nothing to check"
+              exit 0
+            fi
+          else
+            sha=$SHA
+            if [[ -n $PR ]]; then
+              if [[ ! $PR =~ ^[0-9]+$ ]]; then
+                echo "::error::pr must be a pull request number"
+                exit 1
+              fi
+              [[ -n $sha ]] || sha=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR" --jq .head.sha)
+            fi
+            if [[ ! $sha =~ ^[0-9a-f]{40}$ ]]; then
+              echo "::error::head_sha must be a full commit hash"
+              exit 1
+            fi
+            # The newest green pull request build of that commit.
+            run=$(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/build-pr.yml/runs?head_sha=$sha&event=pull_request&status=success&per_page=1" \
+              --jq '.workflow_runs[0].id // empty')
+            if [[ -z $run ]]; then
+              echo "::error::$sha has no green pull request build to check"
+              exit 1
+            fi
+          fi
+          # A fork's pull request builds with its own build-pr.yml, which
+          # writes the dkms-request this check reads. Whether this build's
+          # copy is the base's comes from the build run itself, in every mode.
+          build=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$run")
+          if [[ $(jq -r '.head_sha' <<<"$build") != "$sha" || $(jq -r '.path' <<<"$build") != .github/workflows/build-pr.yml ]]; then
+            echo "::error::run $run is not the pull request build of $sha"
+            exit 1
+          fi
+          # build-pr.yml's blob at a commit, "missing" where it has none (a
+          # fork that branched before it existed); any other error stops here.
+          blob() {
+            local out
+            if out=$(gh api "repos/$GITHUB_REPOSITORY/contents/.github/workflows/build-pr.yml?ref=$1" --jq .sha 2>&1); then
+              echo "$out"
+            elif [[ $out == *"(HTTP 404)"* ]]; then
+              echo missing
+            else
+              echo "::error::cannot read build-pr.yml at $1" >&2
+              return 1
+            fi
+          }
+          if [[ $(jq -r '.head_repository.full_name // ""' <<<"$build") != "$GITHUB_REPOSITORY" ]]; then
+            base=$(gh api "repos/$GITHUB_REPOSITORY/compare/${DEFAULT_BRANCH}...$sha" --jq .merge_base_commit.sha)
+            ours=$(blob "$base")
+            theirs=$(blob "$sha")
+            if [[ ! $ours =~ ^([0-9a-f]{40}|missing)$ || $theirs != "$ours" ]]; then
+              refused="Not checked: this build comes from a fork whose .github/workflows/build-pr.yml differs from its merge base's, and that file writes what this check reads. Land the workflow change in a pull request of its own first."
+            fi
+          fi
+          check=$(jq -n --arg sha "$sha" --arg url "$URL" '{
+              name: "DKMS check", head_sha: $sha, status: "in_progress", details_url: $url,
+              output: {title: "Building DKMS modules against kernel headers", summary: "[Open the run, with every leg](\($url))"}
+            }' | gh api -X POST "repos/$GITHUB_REPOSITORY/check-runs" --input - --jq .id)
+          echo "check run $check on $sha, for build run $run${pr:+ of pull request #$pr}"
+          {
+            echo "head_sha=$sha"
+            echo "build_run=$run"
+            echo "check_run=$check"
+            echo "refused=$refused"
+          } >>"$GITHUB_OUTPUT"
+
+  dkms:
+    name: DKMS
+    needs: target
+    # After a build only for a pull request's open check; daily and by hand
+    # always.
+    if: >-
+      !cancelled() && ((needs.target.result == 'success' && needs.target.outputs.check_run != '' && needs.target.outputs.refused == '')
+        || (github.event_name != 'workflow_run' && needs.target.result == 'skipped'))
+    permissions:
+      contents: read
+      actions: read
+    uses: ./.github/workflows/dkms-matrix.yml
+    with:
+      channel: ${{ inputs.channel || 'edge' }}
+      from: ${{ inputs.from || '' }}
+      from_repos: ${{ inputs.from_repos == true }}
+      all: ${{ inputs.all == true }}
+      build_run: ${{ needs.target.outputs.build_run || '' }}
+      head_sha: ${{ needs.target.outputs.head_sha || '' }}
+
+  # Closes the check with the matrix's verdict. A matrix that stopped before
+  # its summary fails the check (or cancels it), never passes it.
+  report:
+    name: close the check
+    needs: [target, dkms]
+    if: always() && needs.target.result == 'success' && needs.target.outputs.check_run != ''
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      checks: write
+    steps:
+      - name: Close the check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CHECK: ${{ needs.target.outputs.check_run }}
+          REFUSED: ${{ needs.target.outputs.refused }}
+          RESULT: ${{ needs.dkms.result }}
+          CONCLUSION: ${{ needs.dkms.outputs.conclusion }}
+          TITLE: ${{ needs.dkms.outputs.title }}
+          SUMMARY: ${{ needs.dkms.outputs.summary }}
+          URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          if [[ -n $REFUSED ]]; then
+            CONCLUSION=failure TITLE="Not checked" SUMMARY=$REFUSED
+          elif [[ $RESULT == cancelled ]]; then
+            CONCLUSION=cancelled TITLE="Cancelled" SUMMARY="A newer build's check replaced this one. [Open the run]($URL)"
+          elif [[ $CONCLUSION != success && $CONCLUSION != failure ]]; then
+            CONCLUSION=failure TITLE="The DKMS check did not finish ($RESULT)" SUMMARY="[Open the run]($URL)"
+          fi
+          jq -n --arg c "$CONCLUSION" --arg t "$TITLE" --arg s "$SUMMARY" --arg url "$URL" \
+            '{status: "completed", conclusion: $c, details_url: $url, output: {title: $t, summary: $s}}' |
+            gh api -X PATCH "repos/$GITHUB_REPOSITORY/check-runs/$CHECK" --input - --jq '"\(.conclusion): \(.output.title) \(.html_url)"'
diff --git a/.github/workflows/dkms-matrix.yml b/.github/workflows/dkms-matrix.yml
new file mode 100644
index 0000000000..2fab9f52cb
--- /dev/null
+++ b/.github/workflows/dkms-matrix.yml
@@ -0,0 +1,312 @@
+name: DKMS matrix
+
+# Builds DKMS modules against kernel headers on a channel, the way a machine
+# does on an update (bin/check-dkms). A kernel that renames or drops something
+# an out-of-tree module uses turns this red before users reboot into it:
+# linux-omarchy 7.2.8-9 renamed battery_hook_register and the TUXEDO modules
+# stopped building on 4.0.5.
+#
+# The work of the check, for its callers: dkms-check.yml (a pull request's
+# build, daily, by hand) and promote.yml (what a promotion moves).
+#
+# Fanned out: `plan` reads the channel on the host in seconds
+# (bin/check-dkms matrix), and every kernel and DKMS package pair gets its own
+# leg, which installs that kernel's headers and builds that package's trees in
+# a throwaway container. A leg is named for what it builds, so a red one says
+# which pair broke: "build (x86_64, linux-omarchy 7.2.8-13, nvidia-open-dkms
+# 615.78.08-3)". `summary` turns the legs into one verdict (bin/check-dkms
+# report), which dkms-check.yml posts on a pull request as its one check.
+#
+# Read-only, all of it: no job here holds more than contents: read and
+# actions: read, or any secret. A pull request's build is data here: its
+# request is checked against a strict shape (bin/build-artifacts), and its
+# packages are only unpacked inside a leg's throwaway container, where their
+# Makefiles run.
+
+on:
+  workflow_call:
+    inputs:
+      channel:
+        type: string
+        required: true
+      from:
+        description: A promotion's source; the channel is checked as it will be once what differs here moves into it (empty means everything)
+        type: string
+        default: ""
+      packages:
+        description: Only these packages or pkgbases (space-separated); empty means all
+        type: string
+        default: ""
+      from_repos:
+        description: Only the DKMS packages from Arch's repositories, against every kernel
+        type: boolean
+        default: false
+      all:
+        description: Every pair on the channel, with the build's packages in place of the published ones
+        type: boolean
+        default: false
+      build_run:
+        description: A pull request's "Build changed packages" run; its packages are what is checked
+        type: string
+        default: ""
+      head_sha:
+        description: The commit that build was made from
+        type: string
+        default: ""
+    outputs:
+      conclusion:
+        description: success or failure
+        value: ${{ jobs.summary.outputs.conclusion }}
+      legs:
+        description: The kernel and module pairs the check built, as JSON; a promotion compares them under its lock
+        value: ${{ jobs.plan.outputs.legs }}
+      title:
+        description: '"N/M passed, K known broken, F failed", or why nothing was checked'
+        value: ${{ jobs.summary.outputs.title }}
+      summary:
+        description: Markdown, a row per leg
+        value: ${{ jobs.summary.outputs.summary }}
+
+# bin/build-artifacts reads a pull request build's artifacts; the daily plan
+# looks up which legs already built.
+permissions:
+  contents: read
+  actions: read
+
+env:
+  CHANNEL: ${{ inputs.channel }}
+  FROM_CHANNEL: ${{ inputs.from }}
+  PACKAGES: ${{ inputs.packages }}
+  FROM_REPOS: ${{ inputs.from_repos }}
+  ALL: ${{ inputs.all }}
+
+jobs:
+  plan:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    outputs:
+      legs: ${{ steps.plan.outputs.legs }}
+      note: ${{ steps.plan.outputs.note }}
+      local: ${{ steps.plan.outputs.local }}
+    steps:
+      # The caller's commit: master's for a pull request (workflow_run), so a
+      # pull request cannot change the check that judges it.
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Plan the legs
+        id: plan
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BUILD_RUN: ${{ inputs.build_run }}
+          HEAD_SHA: ${{ inputs.head_sha }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          TOOLING: ${{ hashFiles('bin/check-dkms', 'ci/dkms-packages') }}
+        run: |
+          set -euo pipefail
+          sudo apt-get update -qq && sudo apt-get install -y -qq --no-install-recommends libarchive-tools >/dev/null
+          args=(--channel "$CHANNEL")
+          [[ -z $FROM_CHANNEL ]] || args+=(--from "$FROM_CHANNEL")
+          [[ -z $PACKAGES ]] || args+=(--packages "$PACKAGES")
+          [[ $FROM_REPOS != true ]] || args+=(--from-repos)
+          [[ $ALL != true ]] || args+=(--all)
+          note="" legs=""
+          # A pull request's build: exactly what it would publish, that run's
+          # artifacts and the ones its plan reused. The legs get only the
+          # kernels and DKMS packages among them; a build that ships nothing
+          # has none (with all, every pair on the channel still builds).
+          if [[ -n $BUILD_RUN ]]; then
+            if [[ ! $HEAD_SHA =~ ^[0-9a-f]{40}$ ]]; then
+              echo "::error::head_sha must be a full commit hash"
+              exit 1
+            fi
+            git fetch --no-tags --depth=1 origin "$HEAD_SHA"
+            bin/build-artifacts built "$BUILD_RUN" "$HEAD_SHA"
+            if compgen -G 'built/*.pkg.tar.*' >/dev/null; then
+              args+=(--local built --save-local dkms-local)
+              [[ $ALL != true ]] || note="Every pair on the channel, with this build's packages in place"
+            elif [[ $ALL == true ]]; then
+              note="Every pair on the channel; this build ships no packages"
+            else
+              note="This build ships no packages"
+              legs='[]'
+            fi
+          fi
+          # Each architecture on its own, so a failure in either stops here.
+          if [[ -z $legs ]]; then
+            x86_64=$(bin/check-dkms matrix --arch x86_64 "${args[@]}")
+            aarch64=$(bin/check-dkms matrix --arch aarch64 "${args[@]}")
+            legs=$(jq -cn --argjson a "$x86_64" --argjson b "$aarch64" '$a + $b')
+          fi
+          # Daily: a leg that built at these versions before is not built
+          # again; each green leg saves its key (below, the same formula). An
+          # unused cache entry expires after 7 days, so every pair is still
+          # rebuilt weekly, on whatever toolchain edge has by then. Only this
+          # ref's entries count: a pull request's run can save any key under
+          # its own ref, which must not skip a daily leg.
+          if [[ $GITHUB_EVENT_NAME == schedule ]]; then
+            keep='[]'
+            while IFS= read -r leg; do
+              key=$(jq -r --arg c "$CHANNEL" --arg t "${TOOLING:0:16}" \
+                '"dkms-\($c)-\(.arch)-\(.kernel | gsub(" "; "_"))-\(.module | gsub(" "; "_"))-\($t)"' <<<"$leg")
+              hits=$(gh api -X GET "repos/$GITHUB_REPOSITORY/actions/caches" -f key="$key" -f ref="$GITHUB_REF" |
+                jq --arg k "$key" --arg r "$GITHUB_REF" '[.actions_caches[] | select(.key == $k and .ref == $r)] | length')
+              if ((hits)); then
+                echo "built before: $key"
+              else
+                keep=$(jq -c --argjson l "$leg" '. + [$l]' <<<"$keep")
+              fi
+            done < <(jq -c '.[]' <<<"$legs")
+            legs=$keep
+          fi
+          if [[ $legs == '[]' && -z $note && -n $BUILD_RUN ]]; then
+            note="This build ships no kernel or DKMS package"
+          fi
+          shipped=false
+          if compgen -G 'dkms-local/*' >/dev/null; then
+            shipped=true
+          fi
+          {
+            echo "legs=$legs"
+            echo "note=$note"
+            echo "local=$shipped"
+          } >>"$GITHUB_OUTPUT"
+          echo "$(jq length <<<"$legs") leg(s):"
+          jq -r '.[] | "  \(.arch)  \(.kernel)  \(.module)"' <<<"$legs"
+      - name: Keep the packages the legs install
+        if: steps.plan.outputs.local == 'true' && steps.plan.outputs.legs != '[]'
+        uses: actions/upload-artifact@v4
+        with:
+          name: dkms-check-local
+          path: dkms-local
+          if-no-files-found: error
+          retention-days: 1
+          overwrite: true
+
+  # One leg per kernel and DKMS package pair. A static name: GitHub appends
+  # the leg's values, and a skipped job shows its name unevaluated.
+  check:
+    name: build
+    needs: plan
+    if: needs.plan.outputs.legs != '[]' && needs.plan.outputs.legs != ''
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      # A whole channel is about 45 legs; leave hosted runners for the
+      # package builds, which share them.
+      max-parallel: 12
+      matrix:
+        include: ${{ fromJSON(needs.plan.outputs.legs) }}
+    # GitHub-hosted, with no secrets: the check only reads published packages,
+    # and it installs them as root in a throwaway container.
+    runs-on: ${{ matrix.arch == 'aarch64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
+    timeout-minutes: 90
+    env:
+      ARCH: ${{ matrix.arch }}
+      KERNEL: ${{ matrix.kernel }}
+      MODULE: ${{ matrix.module }}
+      RESULT: dkms-result-${{ strategy.job-index }}.json
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Fetch the build's kernels and DKMS packages
+        if: needs.plan.outputs.local == 'true'
+        uses: actions/download-artifact@v4
+        with:
+          name: dkms-check-local
+          path: built
+      # The outcome (passed, known broken, failed, ...) is decided on the
+      # host, from run's exit status, and written to $RESULT for `summary`.
+      - name: Build ${{ matrix.module }} against ${{ matrix.kernel }}
+        run: |
+          args=(--arch "$ARCH" --channel "$CHANNEL" --kernel "$KERNEL" --module "$MODULE" --result "$RESULT")
+          [[ -z $FROM_CHANNEL ]] || args+=(--from "$FROM_CHANNEL")
+          [[ -z $PACKAGES ]] || args+=(--packages "$PACKAGES")
+          [[ $FROM_REPOS != true ]] || args+=(--from-repos)
+          [[ $ALL != true ]] || args+=(--all)
+          [[ ! -d built ]] || args+=(--local built)
+          bin/check-dkms container "${args[@]}"
+      - name: Keep this leg's result
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: dkms-result-${{ strategy.job-index }}
+          path: ${{ env.RESULT }}
+          if-no-files-found: ignore
+          retention-days: 7
+          overwrite: true
+      # The daily plan skips a leg whose key exists (the same formula as there).
+      - name: Remember this leg as built
+        id: seen
+        if: github.event_name == 'schedule'
+        env:
+          TOOLING: ${{ hashFiles('bin/check-dkms', 'ci/dkms-packages') }}
+        run: |
+          key="dkms-$CHANNEL-$ARCH-${KERNEL// /_}-${MODULE// /_}-${TOOLING:0:16}"
+          mkdir -p .dkms-seen
+          echo "$key" > .dkms-seen/key
+          echo "key=$key" >> "$GITHUB_OUTPUT"
+      - if: github.event_name == 'schedule'
+        uses: actions/cache/save@v4
+        with:
+          path: .dkms-seen
+          key: ${{ steps.seen.outputs.key }}
+
+  # One verdict for the run: N/M passed, K known broken, F failed, with a
+  # row per leg. A leg that left no result counts as failed, and so does a
+  # plan that did not finish.
+  summary:
+    needs: [plan, check]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    outputs:
+      conclusion: ${{ steps.verdict.outputs.conclusion }}
+      title: ${{ steps.verdict.outputs.title }}
+      summary: ${{ steps.verdict.outputs.summary }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      # Results are data for jq; nothing here runs them.
+      - name: Fetch the legs' results
+        if: needs.plan.outputs.legs != '[]' && needs.plan.outputs.legs != ''
+        continue-on-error: true
+        uses: actions/download-artifact@v4
+        with:
+          pattern: dkms-result-*
+          path: results
+          merge-multiple: true
+      - name: Decide
+        id: verdict
+        env:
+          LEGS: ${{ needs.plan.outputs.legs }}
+          NOTE: ${{ needs.plan.outputs.note }}
+          PLAN: ${{ needs.plan.result }}
+          URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          mkdir -p results
+          printf '%s\n' "${LEGS:-[]}" >legs.json
+          verdict=$(bin/check-dkms report --legs legs.json --results results --plan "$PLAN" --url "$URL" --note "$NOTE" --channel "$CHANNEL")
+          jq -r .summary <<<"$verdict" >>"$GITHUB_STEP_SUMMARY"
+          eof=$(od -An -N16 -tx1 /dev/urandom | tr -d ' \n')
+          {
+            echo "conclusion=$(jq -r .conclusion <<<"$verdict")"
+            echo "title=$(jq -r .title <<<"$verdict")"
+            echo "summary<<$eof"
+            jq -r .summary <<<"$verdict"
+            echo "$eof"
+          } >>"$GITHUB_OUTPUT"
+          jq -r .title <<<"$verdict"
+      - name: Fail when a leg failed
+        if: steps.verdict.outputs.conclusion != 'success'
+        env:
+          TITLE: ${{ steps.verdict.outputs.title }}
+        run: |
+          echo "::error::DKMS check: $TITLE"
+          exit 1
diff --git a/.github/workflows/promote.yml b/.github/workflows/promote.yml
index b25dd1a2fb..7f00a56534 100644
--- a/.github/workflows/promote.yml
+++ b/.github/workflows/promote.yml
@@ -43,7 +43,24 @@ on:
         default: false
 
 jobs:
+  # Every kernel and DKMS module that moves is built against the other half
+  # first (bin/check-dkms): a kernel that breaks an out-of-tree module, or a
+  # module that no longer builds, stops here instead of reaching the channel.
+  # The check runs on the target as the promotion leaves it: a kernel that
+  # moves alone is built against the target's modules, not the source's.
+  dkms:
+    # dkms-matrix.yml reads Actions data in its other modes, so it asks for it.
+    permissions:
+      contents: read
+      actions: read
+    uses: ./.github/workflows/dkms-matrix.yml
+    with:
+      channel: ${{ startsWith(github.event.inputs.direction, 'edge') && 'rc' || 'stable' }}
+      from: ${{ startsWith(github.event.inputs.direction, 'edge') && 'edge' || 'rc' }}
+      packages: ${{ github.event.inputs.packages }}
+
   promote:
+    needs: dkms
     runs-on: ubuntu-latest
     environment: publish
     # A first promotion into a sparse channel moves gigabytes.
@@ -76,6 +93,37 @@ jobs:
             [[ $p =~ ^[a-z0-9@._+-]+$ ]] || { echo "::error::Not a package name: $p"; exit 1; }
           done
 
+      # The DKMS check ran before this job took the publish lock. A publish in
+      # between can move the source's kernel or the target's modules, and
+      # promote-channel reads the channels again. So plan the same legs now,
+      # under the lock, and stop if they are not the pairs that were built.
+      - name: Check that the channels still hold what the DKMS check built
+        env:
+          FROM: ${{ steps.inputs.outputs.from }}
+          TO: ${{ steps.inputs.outputs.to }}
+          PACKAGES: ${{ github.event.inputs.packages }}
+          CHECKED: ${{ needs.dkms.outputs.legs }}
+        run: |
+          set -euo pipefail
+          sudo apt-get update -qq && sudo apt-get install -y -qq --no-install-recommends libarchive-tools >/dev/null
+          args=(--channel "$TO" --from "$FROM")
+          if [[ -n $PACKAGES ]]; then
+            args+=(--packages "$PACKAGES")
+          fi
+          x86_64=$(bin/check-dkms matrix --arch x86_64 "${args[@]}")
+          aarch64=$(bin/check-dkms matrix --arch aarch64 "${args[@]}")
+          now=$(jq -cn --argjson a "$x86_64" --argjson b "$aarch64" '$a + $b | sort')
+          built=$(jq -c 'sort' <<<"${CHECKED:-[]}")
+          if [[ $now != "$built" ]]; then
+            echo "Built by the DKMS check:"
+            jq -r '.[] | "  \(.arch)  \(.kernel)  \(.module)"' <<<"$built"
+            echo "In the channels now:"
+            jq -r '.[] | "  \(.arch)  \(.kernel)  \(.module)"' <<<"$now"
+            echo "::error title=DKMS check::$FROM or $TO changed after the DKMS check; run the promotion again"
+            exit 1
+          fi
+          echo "$TO and $FROM still hold the $(jq length <<<"$now") pair(s) the DKMS check built"
+
       - name: Promote
         id: promote
         env:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index acd90718dc..ea6244f1fb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -90,6 +90,9 @@ jobs:
       - name: Test upstream sync reporting
         run: node --test tests/sync-upstream-summary.cjs
 
+      - name: Test the DKMS check's workflows
+        run: node --test tests/dkms-check-workflow.cjs
+
       - name: Test builder images
         run: node --test tests/builder-image.cjs
 
@@ -134,6 +137,8 @@ jobs:
               python tests/workflow-helpers-sourced.py
               ./tests/build-matrix.sh
               ./tests/mac-installer-dispatch.sh
+              ./tests/check-dkms.sh
+              ./tests/build-artifacts.sh
               ./tests/limine-mkinitcpio-hook.sh
               ./tests/voxtype-bin-install.sh
               ./tests/1password-polkit-owners.sh
diff --git a/bin/build-artifacts b/bin/build-artifacts
new file mode 100755
index 0000000000..75341b88a4
--- /dev/null
+++ b/bin/build-artifacts
@@ -0,0 +1,167 @@
+#!/bin/bash
+# The packages a pull request build ships, into <dest>: the artifacts that
+# run built, and the ones its plan reused from an earlier run (build-pr.yml
+# skips a package whose exact tree already has an artifact). A matrix entry
+# with no artifact in the run built nothing because edge already holds its
+# version, so nothing new ships for it. A reused artifact that cannot be
+# found, or any download or extraction error, fails: the DKMS check must see
+# everything that would publish.
+#
+# The build records what it planned in its dkms-request artifact (\A and \z,
+# not ^ and $, which in jq would let a trailing newline through):
+#   {"trusted": bool, "matrix": {"include": [{"package", "arch"}, ...]},
+#    "reused": ["<package>-<arch>-<tree hash>", ...]}
+# A pull request's run wrote it, so it is data: checked against a strict
+# shape before any of it names a path or a URL. An untrusted build built
+# nothing, so it ships nothing.
+#
+# A reused artifact was made by another run, and any run can upload an
+# artifact under any name: a fork's pull request with its own workflow could
+# upload one named for another pull request's package tree. So a reused
+# artifact counts only when its run is this repository's build-pr.yml, and a
+# fork's run only when its build-pr.yml is its merge base's: the rule
+# dkms-check.yml applies to the build it checks. The newest such artifact
+# wins; none fails.
+#
+# Usage: bin/build-artifacts <dest> <run id> <head sha>
+#   Needs gh (GH_TOKEN), bsdtar and GITHUB_REPOSITORY, in a checkout that has
+#   <head sha>. DEFAULT_BRANCH names the branch forks are compared with (by
+#   default the repository's).
+set -euo pipefail
+
+die() { echo "build-artifacts: $*" >&2; exit 2; }
+(($# == 3)) || die "usage: bin/build-artifacts <dest> <run id> <head sha>"
+dest=$1 run=$2 head=$3
+repo=${GITHUB_REPOSITORY:?build-artifacts needs GITHUB_REPOSITORY}
+[[ $run =~ ^[0-9]+$ ]] || die "run id $run is not a number"
+mkdir -p "$dest"
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+
+# Each artifact unpacks into a fresh directory and must yield packages; every
+# file is then copied with its own error check.
+fetch() { # fetch <artifact id> <label>
+  local id=$1 label=$2 f n=0
+  gh api "repos/$repo/actions/artifacts/$id/zip" >"$work/$label.zip" || die "cannot download artifact $label"
+  mkdir -p "$work/$label" "$work/$label.out"
+  bsdtar -xf "$work/$label.zip" -C "$work/$label" || die "cannot unzip artifact $label"
+  if [[ -f $work/$label/packages.tar ]]; then
+    tar -xf "$work/$label/packages.tar" -C "$work/$label.out" || die "cannot unpack artifact $label"
+  else
+    for f in "$work/$label"/*.pkg.tar.zst; do
+      [[ -e $f || -L $f ]] || continue
+      [[ ${f##*/} =~ ^[A-Za-z0-9@_+][A-Za-z0-9@._+:~-]*\.pkg\.tar\.zst$ ]] ||
+        die "artifact $label holds a file whose name makepkg would not produce"
+      [[ -f $f && ! -L $f ]] || die "artifact $label holds ${f##*/}, which is not a regular file"
+      cp -- "$f" "$work/$label.out/" || die "cannot copy ${f##*/} from artifact $label"
+    done
+  fi
+  for f in "$work/$label.out"/*.pkg.tar.*; do
+    [[ $f != *.sig && (-e $f || -L $f) ]] || continue
+    # The name goes into logs and tab-separated plans: makepkg's names only,
+    # and an odd one is not repeated.
+    [[ ${f##*/} =~ ^[A-Za-z0-9@_+][A-Za-z0-9@._+:~-]*\.pkg\.tar\.[a-z0-9]+$ ]] ||
+      die "artifact $label holds a file whose name makepkg would not produce"
+    # A link would copy whatever it points at on this runner.
+    [[ -f $f && ! -L $f ]] || die "artifact $label holds ${f##*/}, which is not a regular file"
+    cp -- "$f" "$dest/" || die "cannot copy ${f##*/} from artifact $label"
+    n=$((n + 1))
+  done
+  ((n)) || die "artifact $label holds no package"
+  echo "$label: $n package(s)"
+}
+
+# build-pr.yml's blob at a commit, "missing" where it has none (a fork that
+# branched before it existed); any other error stops the collection.
+blob() {
+  local out
+  if out=$(gh api "repos/$repo/contents/.github/workflows/build-pr.yml?ref=$1" --jq .sha 2>&1); then
+    echo "$out"
+  elif [[ $out == *"(HTTP 404)"* ]]; then
+    echo missing
+  else
+    die "cannot read build-pr.yml at $1"
+  fi
+}
+
+# Whether a run may vouch for an artifact (see the top).
+declare -A vouches=()
+trusted_run() { # trusted_run <run id>
+  local id=$1 info head_repo head_sha base ours theirs
+  [[ $id =~ ^[0-9]+$ ]] || return 1
+  [[ -z ${vouches[$id]:-} ]] || return "${vouches[$id]}"
+  info=$(gh api "repos/$repo/actions/runs/$id") || die "cannot read run $id"
+  vouches[$id]=1
+  [[ $(jq -r .path <<<"$info") == .github/workflows/build-pr.yml ]] || return 1
+  [[ $(jq -r .event <<<"$info") =~ ^(pull_request|workflow_dispatch)$ ]] || return 1
+  head_repo=$(jq -r '.head_repository.full_name // ""' <<<"$info")
+  head_sha=$(jq -r '.head_sha // ""' <<<"$info")
+  if [[ $head_repo != "$repo" ]]; then
+    [[ $head_sha =~ ^[0-9a-f]{40}$ ]] || return 1
+    default=${DEFAULT_BRANCH:-$(gh api "repos/$repo" --jq .default_branch)} || die "cannot read the default branch"
+    base=$(gh api "repos/$repo/compare/$default...$head_sha" --jq .merge_base_commit.sha) ||
+      die "cannot find the merge base of run $id's commit"
+    ours=$(blob "$base") || exit 2
+    theirs=$(blob "$head_sha") || exit 2
+    [[ $ours =~ ^([0-9a-f]{40}|missing)$ && $theirs == "$ours" ]] || return 1
+  fi
+  vouches[$id]=0
+}
+
+# This run's artifacts, by name.
+mine=$(gh api --paginate "repos/$repo/actions/runs/$run/artifacts" --jq '.artifacts[] | select(.expired | not) | "\(.name)\t\(.id)"') ||
+  die "cannot list run $run's artifacts"
+
+id=$(awk -F'\t' '$1 == "dkms-request" { print $2; exit }' <<<"$mine")
+[[ -n $id ]] || die "run $run has no dkms-request artifact; it is not a pull request build this check can read"
+gh api "repos/$repo/actions/artifacts/$id/zip" >"$work/request.zip" || die "cannot download run $run's dkms-request"
+mkdir -p "$work/request"
+bsdtar -xf "$work/request.zip" -C "$work/request" || die "cannot unzip run $run's dkms-request"
+request=$work/request/dkms-request.json
+jq -e '
+  (.trusted | type) == "boolean"
+  and (.matrix.include | type) == "array"
+  and all(.matrix.include[]; (.package | type) == "string" and (.package | test("\\A[A-Za-z0-9@_+][A-Za-z0-9@._+-]*\\z"))
+    and (.arch == "x86_64" or .arch == "aarch64"))
+  and (.reused | type) == "array"
+  and all(.reused[]; type == "string" and test("\\A[A-Za-z0-9@_+][A-Za-z0-9@._+-]*-(x86_64|aarch64)-[0-9a-f]{40}\\z"))' \
+  "$request" >/dev/null 2>&1 || die "run $run's dkms-request is malformed"
+if [[ $(jq -r .trusted "$request") != true ]]; then
+  echo "run $run: the build was not approved, so it built nothing"
+  exit 0
+fi
+matrix=$(jq -c .matrix "$request")
+reused=$(jq -c .reused "$request")
+
+while IFS=$'\t' read -r package arch; do
+  [[ -n $package ]] || continue
+  tree=$(git rev-parse -q --verify "$head:pkgbuilds/$package") || die "no pkgbuilds/$package at $head"
+  label=$package-$arch-$tree
+  id=$(awk -F'\t' -v l="$label" '$1 == l { print $2; exit }' <<<"$mine")
+  if [[ -z $id ]]; then
+    echo "$label: nothing built (edge already holds this version)"
+    continue
+  fi
+  fetch "$id" "$label"
+done < <(jq -r '.include[] | "\(.package)\t\(.arch)"' <<<"$matrix")
+
+while IFS= read -r label; do
+  [[ -n $label ]] || continue
+  # Every page, newest first across them: untrusted uploads in front must
+  # not hide a trusted one behind.
+  candidates=$(gh api --paginate "repos/$repo/actions/artifacts?name=$label&per_page=100" \
+    --jq '.artifacts[] | select(.expired | not) | "\(.created_at)\t\(.id)\t\(.workflow_run.id // "")"') ||
+    die "cannot look up artifact $label"
+  candidates=$(sort -r <<<"$candidates" | cut -f2-)
+  [[ -n $candidates ]] || die "the plan reused artifact $label, which no longer exists; rerun the build"
+  id=""
+  while IFS=$'\t' read -r artifact producer; do
+    if trusted_run "$producer"; then
+      id=$artifact
+      break
+    fi
+    echo "$label: artifact $artifact skipped: run $producer cannot vouch for it"
+  done <<<"$candidates"
+  [[ -n $id ]] || die "no artifact $label comes from a build this check trusts; rerun the build"
+  fetch "$id" "$label"
+done < <(jq -r '.[]' <<<"$reused")
diff --git a/bin/check-dkms b/bin/check-dkms
new file mode 100755
index 0000000000..00db7dc3fc
--- /dev/null
+++ b/bin/check-dkms
@@ -0,0 +1,900 @@
+#!/bin/bash
+# Build DKMS modules against kernel headers the way a machine does on an
+# update: install the headers, then `dkms build` each module source tree for
+# each kernel. A kernel that renames or drops something an out-of-tree module
+# uses fails here instead of on users' machines (linux-omarchy 7.2.8-9 renamed
+# battery_hook_register, and the TUXEDO modules stopped building).
+#
+# Only what changes is checked: a kernel/module pair builds when either side is
+# a package in --local (a pull request's fresh build) or one that moves in from
+# --from (a promotion into the channel). The pairs are the ones the channel's
+# machines will have: the channel's own packages, with the fresh or moving ones
+# in place of theirs. With neither option, everything is checked. --packages
+# narrows it to the named packages or pkgbases; in a promotion, only they move.
+#
+# Some DKMS packages Omarchy installs come from Arch's own repositories, not
+# from this one (ci/dkms-packages marks them repo=<name>). They are read from
+# the channel's Arch mirror, the snapshot that channel's machines install
+# from. They never move with this repository, so they are checked whenever a
+# kernel changes; --from-repos checks only them, against every kernel. The
+# daily CI run (dkms-check.yml) checks every pair on edge that has not built
+# at its versions before, which catches Arch updating one of them.
+#
+# Usage:
+#   bin/check-dkms plan --arch <arch> --files-db <omarchy.files>
+#                       [--local <dir> | --from-db <omarchy.files>]
+#                       [--repo-files-db <repo>=<repo.files> ...] [--from-repos]
+#       Print the kernels, the DKMS packages and the pairs a run would build.
+#   bin/check-dkms matrix --arch <arch> [--channel <channel> | --files-db <omarchy.files>]
+#                         [the options of run or plan] [--save-local <dir>] [--all]
+#       Print the run's legs as a JSON array for a CI matrix, [] for none: one
+#       {"arch", "kernel": "<pkgbase> <version>", "module": "<name> <version>"}
+#       per kernel and DKMS package it builds. Runs on the host (curl and
+#       bsdtar). --save-local copies --local's kernels and DKMS packages, all
+#       the legs need, into <dir>. --all keeps every pair of the channel, not
+#       only those that touch --local's packages, which stand in for theirs.
+#   bin/check-dkms run --arch <arch> --channel <channel> [--local <dir> | --from <channel>]
+#                      [--packages "<name|pkgbase> ..."] [--from-repos]
+#                      [--kernel "<name|pkgbase> [version]"] [--module "<name> [version]"]
+#                      [--results <dir>] [--all]
+#       Run the check, as root, in a disposable Arch (x86_64) or Arch Linux ARM
+#       (aarch64) system: it installs packages. --kernel and --module keep only
+#       the pairs of one leg, at the versions the leg names.
+#       --results <dir> keeps each pair's verdict in <dir>/pairs.tsv.
+#   bin/check-dkms container <same options as run> [--result <file>]
+#       Run it in a throwaway container of the right image (needs Docker).
+#       --result writes the outcome as JSON: {"arch", "kernel", "module",
+#       "outcome": passed|excluded|known-broken|fixed|failed|error, "detail"}.
+#       Exits 0 for passed, excluded and known-broken.
+#   bin/check-dkms report --legs <legs.json> --results <dir> [--plan <job result>]
+#                         [--url <run>] [--note <text>] [--channel <channel>]
+#       The verdict of a CI run, from its matrix legs and the --result files
+#       in <dir>: {"conclusion", "title", "summary"} as JSON. A leg without a
+#       result failed, and a plan that did not succeed fails the run.
+#   bin/check-dkms judge --arch <arch> < <raw results>
+#       Judge run's raw results ("<kernel> <kver> <package> <tree> <built|
+#       excluded|failed> <note>" per line) against ci/dkms-packages: a
+#       known-broken package that fails is expected, one that builds fails.
+#       Prints each pair with its verdict and text; exits 1 on a failure.
+#   bin/check-dkms toolchain <kernel build tree>...
+#       Print the packages a DKMS build needs beyond base-devel for these
+#       kernels: "clang llvm lld" when one was built with clang, else nothing.
+set -euo pipefail
+
+ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
+REGISTRY=${OMARCHY_DKMS_REGISTRY:-$ROOT/ci/dkms-packages}
+PKGS_BASE=${OMARCHY_PKGS_BASE:-https://pkgs.omarchy.org}
+X86_64_IMAGE=${OMARCHY_DKMS_X86_64_IMAGE:-ghcr.io/archlinux/archlinux:base-devel}
+# The kernels the check builds against, by pkgbase: Omarchy's own. Any other
+# kernel a channel publishes, such as linux-aurora, is left out with a note.
+# A glob; '*' takes every kernel.
+KERNELS=${OMARCHY_DKMS_KERNELS:-linux-omarchy*}
+AARCH64_IMAGE=${OMARCHY_DKMS_AARCH64_IMAGE:-ghcr.io/menci/archlinuxarm@sha256:3e1074c407fc1a57c2a2117af6920c96a7cc906fa6f1f2da8a4a7fd3aa2c2f4e}
+
+die() { echo "check-dkms: $*" >&2; exit 2; }
+usage() { sed -n '/^# Usage:/,/^set -euo/p' "$0" | sed '$d; s/^# \{0,1\}//' >&2; exit 2; }
+
+# A kernel built with clang (linux-aurora) needs its modules built with clang:
+# DKMS reads CONFIG_CC_IS_CLANG from the build tree and passes LLVM=1 to make,
+# which runs clang, ld.lld and the llvm-* tools from PATH.
+toolchain() {
+  local tree
+  for tree in "$@"; do
+    if grep -qx 'CONFIG_CC_IS_CLANG=y' "$tree/.config" 2>/dev/null; then
+      echo "clang llvm lld"
+      return
+    fi
+  done
+}
+
+mode=${1:-}
+[[ -n $mode ]] || usage
+shift
+if [[ $mode == toolchain ]]; then
+  (($#)) || usage
+  toolchain "$@"
+  exit 0
+fi
+arch="" channel="" files_db="" local_dir="" from="" from_db="" only="" from_repos=0
+pair_kernel="" pair_module="" save_local="" results_dir="" all_pairs=0
+result_file="" legs_file="" plan_result="" run_url="" note=""
+repo_dbs=()
+while (($#)); do
+  case $1 in
+    --arch) arch=${2:?--arch needs a value}; shift 2 ;;
+    --channel) channel=${2:?--channel needs a value}; shift 2 ;;
+    --files-db) files_db=${2:?--files-db needs a value}; shift 2 ;;
+    --local) local_dir=${2:?--local needs a value}; shift 2 ;;
+    --from) from=${2:?--from needs a channel}; shift 2 ;;
+    --from-db) from_db=${2:?--from-db needs a value}; shift 2 ;;
+    --packages) only=${2-}; shift 2 ;;
+    --repo-files-db) repo_dbs+=("${2:?--repo-files-db needs <repo>=<file>}"); shift 2 ;;
+    --from-repos) from_repos=1; shift ;;
+    --kernel) pair_kernel=${2:?--kernel needs a value}; shift 2 ;;
+    --module) pair_module=${2:?--module needs a value}; shift 2 ;;
+    --save-local) save_local=${2:?--save-local needs a value}; shift 2 ;;
+    --results) results_dir=${2:?--results needs a directory}; shift 2 ;;
+    --all) all_pairs=1; shift ;;
+    --result) result_file=${2:?--result needs a file}; shift 2 ;;
+    --legs) legs_file=${2:?--legs needs a file}; shift 2 ;;
+    --plan) plan_result=${2-}; shift 2 ;;
+    --url) run_url=${2-}; shift 2 ;;
+    --note) note=${2-}; shift 2 ;;
+    *) usage ;;
+  esac
+done
+
+# A CI run's verdict, for its summary and the pull request's single check.
+# Leg names and details come from package metadata a pull request controls,
+# so they are reduced to plain text before they reach the markdown.
+report() {
+  [[ -f $legs_file ]] || die "report needs --legs <file>"
+  [[ -d $results_dir ]] || die "report needs --results <dir>"
+  local leg_results=()
+  shopt -s nullglob
+  leg_results=("$results_dir"/*.json)
+  shopt -u nullglob
+  jq -n --slurpfile legs "$legs_file" --slurpfile results <(cat /dev/null "${leg_results[@]}") \
+    --arg plan "$plan_result" --arg url "$run_url" --arg note "$note" --arg channel "$channel" '
+    def clean: tostring | gsub("[[:cntrl:]|<>`*\\[\\]\\\\]"; " ") | .[0:400];
+    # In a code span, so a name cannot mention anyone or become a link.
+    def code: clean | if . == "" then "" else "`" + . + "`" end;
+    def rank: {failed: 0, error: 0, missing: 0, fixed: 1, "known-broken": 2, passed: 3, excluded: 4}[.] // 0;
+    def word: {failed: "failed", error: "error", missing: "no result", fixed: "builds now",
+      "known-broken": "known broken", passed: "passed", excluded: "excluded"}[.] // (. | clean);
+    ($legs[0] // []) as $all
+    | ($all | map(. as $leg
+        | ([$results[] | select(.arch == $leg.arch and .kernel == $leg.kernel and .module == $leg.module)] | first) as $r
+        | $leg + {outcome: ($r.outcome // "missing"), detail: (if $r == null then "the leg left no result" else ($r.detail // "") end)})) as $rows
+    | ($rows | length) as $m
+    | ([$rows[] | select(.outcome == "passed" or .outcome == "excluded")] | length) as $n
+    | ([$rows[] | select(.outcome == "known-broken")] | length) as $k
+    | ($m - $n - $k) as $f
+    | (if $url == "" then "" else "[Open the run, with every leg](\($url))" end) as $link
+    | (if $channel == "" then "" else " on \($channel | clean)" end) as $where
+    | if $plan != "" and $plan != "success" then
+        {conclusion: "failure", title: "The DKMS plan did not finish",
+         summary: "The plan ended as \($plan | clean), so nothing was checked. \($link)"}
+      elif $m == 0 then
+        {conclusion: "success", title: "Nothing to check",
+         summary: ((if $note == "" then "Nothing to build" + $where else ($note | clean) end) + ". " + $link)}
+      else
+        ("\($n)/\($m) passed" + (if $k > 0 then ", \($k) known broken" else "" end)
+          + (if $f > 0 then ", \($f) failed" else "" end)) as $title
+        | {conclusion: (if $f == 0 then "success" else "failure" end), title: $title,
+           summary: ([
+             "**\($title)**" + $where + "." + (if $note == "" then "" else " " + ($note | clean) + "." end),
+             "", $link, "",
+             "| Result | Arch | Kernel | Module | Detail |", "|---|---|---|---|---|"]
+             + ($rows | sort_by((.outcome | rank), .arch, .kernel, .module)
+                | map("| \(.outcome | word) | \(.arch | clean) | \(.kernel | code) | \(.module | code) | \(.detail | code) |"))
+             | join("\n"))}
+      end'
+}
+if [[ $mode == report ]]; then
+  report
+  exit 0
+fi
+
+case $arch in x86_64 | aarch64) ;; *) die "--arch must be x86_64 or aarch64" ;; esac
+# run, and matrix without --files-db, download the channel's databases and the
+# repo= packages' from its mirror; plan only reads the files it is given.
+download=0
+[[ $mode != run && ($mode != matrix || -n $files_db) ]] || download=1
+REPO_CHANNEL=""
+((!download)) || REPO_CHANNEL=$channel
+if [[ -n $local_dir ]]; then
+  [[ -d $local_dir ]] || die "--local $local_dir is not a directory"
+  [[ -z $from && -z $from_db ]] || die "--local and --from are two different checks; give one"
+fi
+
+# The registry's entries for this architecture, one line each:
+#   <package> <kernels=, or -> <repo=, or -> <known-broken= reason, or ->
+# A reason is quoted and may hold spaces, so it is taken out of the line
+# before the fields are read. A field the registry does not know is an error:
+# a misspelt mark must not silently stop applying.
+read_registry() {
+  awk -v a="$arch" '
+    /^[[:space:]]*(#|$)/ { next }
+    {
+      why = "-"
+      if (match($0, /known-broken="[^"]*"/)) {
+        why = substr($0, RSTART + 14, RLENGTH - 15)
+        $0 = substr($0, 1, RSTART - 1) " " substr($0, RSTART + RLENGTH)
+        if (why == "") { print "check-dkms: " FILENAME ":" FNR ": known-broken needs a reason" > "/dev/stderr"; bad = 1 }
+      }
+      ok = 0; k = "-"; r = "-"
+      for (i = 2; i <= NF; i++) {
+        if ($i == "x86_64" || $i == "aarch64") { if ($i == a) ok = 1 }
+        else if ($i ~ /^kernels=./) k = substr($i, 9)
+        else if ($i ~ /^repo=./) r = substr($i, 6)
+        else { print "check-dkms: " FILENAME ":" FNR ": unknown field " $i > "/dev/stderr"; bad = 1 }
+      }
+      if (ok) print $1 "\t" k "\t" r "\t" why
+    }
+    END { exit bad }' "$REGISTRY"
+}
+ENTRIES=$(read_registry) || die "$REGISTRY has errors"
+# The DKMS packages ci/dkms-packages lists for this architecture, and the
+# kernels each is limited to ("<package> <headers>,..."; none means every one,
+# and "!<headers>" every one but those).
+LISTED=$(cut -f1 <<<"$ENTRIES" | sed '/^$/d')
+SCOPES=$(awk -F'\t' '$2 != "-" { print $1 "\t" $2 }' <<<"$ENTRIES")
+is_listed() { grep -qxF -- "$1" <<<"$LISTED"; }
+# The listed packages that come from an Arch repository: "<package> <repo>".
+REPOS=$(awk -F'\t' '$3 != "-" { print $1 "\t" $3 }' <<<"$ENTRIES")
+from_repo() { awk -F'\t' -v n="$1" '$1 == n { f = 1 } END { exit !f }' <<<"$REPOS"; }
+# The listed packages known not to build, with the reason: "<package> <why>".
+# The check expects them to fail, and fails when one builds, so the mark
+# comes off as soon as it is wrong.
+BROKEN=$(awk -F'\t' '$4 != "-" { print $1 "\t" $4 }' <<<"$ENTRIES")
+
+# Raw results on stdin ("<kernel> <kver> <package> <tree> <built|excluded|
+# failed> <note>") to verdicts: the same fields with the outcome replaced by
+# built, excluded, failed, known-broken or fixed, and the note by the text a
+# person reads. Exits 1 when a pair failed or a known-broken one built.
+judge() {
+  awk -F'\t' -v OFS='\t' '
+    FNR == 1 { file++ }
+    file == 1 { if ($1 != "") why[$1] = $2; next }
+    $1 == "" { next }
+    {
+      verdict = $5
+      if ($5 == "built") text = "built"
+      else if ($5 == "excluded") text = "excluded (BUILD_EXCLUSIVE)"
+      else if ($5 == "failed") text = "FAILED"
+      else { print "check-dkms: unknown outcome " $5 " for " $3 > "/dev/stderr"; exit 2 }
+      if ($3 in why) {
+        if ($5 == "failed") { verdict = "known-broken"; text = "known broken: " why[$3] }
+        else if ($5 == "built") { verdict = "fixed"; text = "FAILED: builds now; remove its known-broken mark from ci/dkms-packages (" why[$3] ")" }
+      }
+      if (verdict == "failed" || verdict == "fixed") failed = 1
+      if ($6 != "" && $6 != "-") text = text " (" $6 ")"
+      print $1, $2, $3, $4, verdict, text
+    }
+    END { exit failed }' <(printf '%s\n' "$BROKEN") -
+}
+# The repo= packages this plan really takes from Arch: those this repository
+# does not build itself. Set by plan_for; empty when none were needed.
+ARCH_SOURCED=""
+# Where the packages that move in from --from are downloaded: set with it.
+FROM_PREFIX=""
+
+# Where a channel's machines get Arch packages: each channel has its own
+# snapshot on both architectures (default/pacman/mirrorlist-* in
+# omacom/omarchy), the same mirrors build/Dockerfile builds against.
+# Printed as pacman Server lines: $repo and $arch stay literal.
+# shellcheck disable=SC2016
+mirror_server() {
+  case $arch:$1 in
+    x86_64:edge) echo 'https://mirror.omarchy.org/$repo/os/$arch' ;;
+    x86_64:rc) echo 'https://rc-mirror.omarchy.org/$repo/os/$arch' ;;
+    x86_64:stable) echo 'https://stable-mirror.omarchy.org/$repo/os/$arch' ;;
+    aarch64:edge) echo 'https://arm-mirror.omarchy.org/$arch/$repo' ;;
+    aarch64:rc) echo 'https://arm-rc-mirror.omarchy.org/$arch/$repo' ;;
+    aarch64:stable) echo 'https://arm-stable-mirror.omarchy.org/$arch/$repo' ;;
+    *) die "no Arch mirror is known for channel $1 on $arch" ;;
+  esac
+}
+# The URL of an Arch repository's directory for a channel.
+repo_url() { # repo_url <channel> <repo>
+  local server
+  server=$(mirror_server "$1")
+  server=${server//\$repo/$2}
+  echo "${server//\$arch/$arch}"
+}
+
+# A package's role from its file list on stdin: "kernel <kver>" for headers
+# with a build tree, "dkms <tree>[,<tree>]" for DKMS sources, else "other".
+# A transitional headers package that ships no tree is "other".
+classify() {
+  awk '
+    /^usr\/lib\/modules\/[^\/]+\/build\/Makefile$/ { split($0, p, "/"); kver = p[4] }
+    /^usr\/src\/[^\/]+\/dkms.conf$/ { split($0, p, "/"); trees = trees (trees == "" ? "" : ",") p[3] }
+    END { if (kver != "") print "kernel\t" kver; else if (trees != "") print "dkms\t" trees; else print "other\t-" }'
+}
+
+# Every package of a files database, one line each:
+#   <kind> <name> <version> <file> <sha256> <kver|trees|-> <pkgbase>
+read_db() { # read_db <db> [prefix for its file names]
+  local db=$1 prefix=${2:-} dir
+  dir=$(mktemp -d)
+  bsdtar -xf "$db" -C "$dir" || { rm -rf "$dir"; die "cannot read $db"; }
+  read_entries "$dir" "$db" "$prefix" || { rm -rf "$dir"; exit 2; }
+  rm -rf "$dir"
+}
+
+read_entries() { # read_entries <unpacked db> <db, for errors> <file prefix>
+  local dir=$1 db=$2 prefix=$3 entry name version file sha base role
+  for entry in "$dir"/*/; do
+    [[ -f $entry/desc ]] || continue
+    [[ -f $entry/files ]] || { echo "check-dkms: $db is not a files database (no file lists)" >&2; return 1; }
+    name=$(awk '$0 == "%NAME%" { getline; print; exit }' "$entry/desc")
+    version=$(awk '$0 == "%VERSION%" { getline; print; exit }' "$entry/desc")
+    file=$(awk '$0 == "%FILENAME%" { getline; print; exit }' "$entry/desc")
+    sha=$(awk '$0 == "%SHA256SUM%" { getline; print; exit }' "$entry/desc")
+    base=$(awk '$0 == "%BASE%" { getline; print; exit }' "$entry/desc")
+    role=$(classify <"$entry/files")
+    printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\n' "${role%%$'\t'*}" "$name" "$version" "$prefix$file" "$sha" "${role#*$'\t'}" "${base:-$name}"
+  done
+}
+
+# The repo= packages, read from their Arch repositories' files databases
+# (<repo>=<file> pairs). Only their own entries are unpacked: a repository
+# holds thousands. A listed package missing from its repository, or one that
+# ships no DKMS tree there, is an error. With a channel, file names become URLs
+# on that channel's mirror, so fetch downloads them from there.
+read_repos() { # read_repos <channel or ""> <repo>=<file>...
+  local channel=$1 spec repo db dir name line prefix out="" patterns=() names=()
+  shift
+  for spec in "$@"; do
+    repo=${spec%%=*} db=${spec#*=}
+    mapfile -t names < <(awk -F'\t' -v r="$repo" '$2 == r { print $1 }' <<<"$REPOS")
+    ((${#names[@]})) || continue
+    [[ -f $db ]] || die "no files database for repository $repo ($db)"
+    patterns=()
+    for name in "${names[@]}"; do patterns+=("$name-[0-9]*"); done
+    dir=$(mktemp -d)
+    # bsdtar complains about a pattern that matches nothing; checked below.
+    bsdtar -xf "$db" -C "$dir" "${patterns[@]}" 2>/dev/null || true
+    prefix=""
+    [[ -z $channel ]] || prefix="$(repo_url "$channel" "$repo")/"
+    line=$(read_entries "$dir" "$db" "$prefix") || { rm -rf "$dir"; exit 2; }
+    rm -rf "$dir"
+    for name in "${names[@]}"; do
+      awk -F'\t' -v n="$name" '$1 == "dkms" && $2 == n { f = 1 } END { exit !f }' <<<"$line" ||
+        die "$name is listed as coming from $repo, but $repo has no DKMS package of that name"
+    done
+    out+=$(awk -F'\t' 'FNR == 1 { file++ } file == 1 { w[$0] = 1; next } ($2 in w)' \
+      <(printf '%s\n' "${names[@]}") <(printf '%s\n' "$line"))$'\n'
+  done
+  while IFS=$'\t' read -r name repo; do
+    [[ -n $name ]] || continue
+    grep -q "^dkms"$'\t'"$name"$'\t' <<<"$out" || die "no files database given for $name's repository, $repo"
+  done <<<"$REPOS"
+  printf '%s' "$out" | sed '/^$/d'
+}
+
+# The same lines for the packages in --local built for this architecture.
+read_local() {
+  local pkg info name version parch base list role found=0
+  for pkg in "$local_dir"/*.pkg.tar.*; do
+    [[ -f $pkg && $pkg != *.sig ]] || continue
+    # Its path goes into tab-separated lines and logs: a name with a tab or
+    # "##[" in it is refused, and not repeated.
+    [[ ${pkg##*/} =~ ^[A-Za-z0-9@_+][A-Za-z0-9@._+:~-]*\.pkg\.tar\.[a-z0-9]+$ ]] ||
+      die "--local holds a package file whose name makepkg would not produce"
+    info=$(bsdtar -xOf "$pkg" .PKGINFO) || die "cannot read $pkg"
+    name=$(awk -F' = ' '$1 == "pkgname" { print $2; exit }' <<<"$info")
+    version=$(awk -F' = ' '$1 == "pkgver" { print $2; exit }' <<<"$info")
+    parch=$(awk -F' = ' '$1 == "arch" { print $2; exit }' <<<"$info")
+    base=$(awk -F' = ' '$1 == "pkgbase" { print $2; exit }' <<<"$info")
+    [[ -n $name && -n $version ]] || die "$pkg has no pkgname or pkgver"
+    # A pull request built these, so their names reach logs, job outputs and
+    # the check's markdown: only what makepkg itself allows.
+    [[ $name =~ ^[A-Za-z0-9@_+][A-Za-z0-9@._+-]*$ && ${base:-$name} =~ ^[A-Za-z0-9@_+][A-Za-z0-9@._+-]*$ ]] ||
+      die "${pkg##*/} has a package name makepkg would not allow"
+    [[ $version =~ ^[A-Za-z0-9._+~:-]+$ ]] || die "${pkg##*/} has a version makepkg would not allow"
+    [[ $parch == "$arch" || $parch == any ]] || continue
+    list=$(bsdtar -tf "$pkg") || die "cannot list $pkg"
+    role=$(classify <<<"$list")
+    [[ ${role#*$'\t'} =~ ^[A-Za-z0-9@._+~,-]+$ ]] || die "${pkg##*/} ships a kernel or DKMS tree with a name makepkg would not allow"
+    printf '%s\t%s\t%s\t%s\t-\t%s\t%s\n' "${role%%$'\t'*}" "$name" "$version" "$pkg" "${role#*$'\t'}" "${base:-$name}"
+    found=1
+  done
+  # matrix asks about each architecture; one with nothing built has no legs.
+  ((found || all_pairs)) || [[ $mode == matrix ]] || die "--local $local_dir holds no package for $arch"
+}
+
+# What a promotion moves into the channel: --from's packages at a version the
+# channel does not have (missing here counts), narrowed by --packages. A
+# fast-ring package is at the same version everywhere, so it never shows here;
+# a pinned one would be checked as if it moved, which only adds pairs.
+moving() { # moving <published> <--from's packages>
+  awk -F'\t' -v only=" $only " 'FNR == 1 { file++ }
+    file == 1 { if ($2 != "") v[$2] = $3; next }
+    $2 != "" && v[$2] != $3 && (only == "  " || index(only, " " $2 " ") || index(only, " " $7 " "))' \
+    <(printf '%s\n' "$1") <(printf '%s\n' "$2")
+}
+
+# The packages a check runs over: the channel's, with --local's (or what
+# moves in from --from) in place of the published ones of the same name. A local package that no longer ships
+# the headers tree or dkms.conf its published one did is an error: the
+# published one must not quietly stand in for it.
+compose() {
+  local published=$1 fresh=$2 kind name pkind
+  while IFS=$'\t' read -r kind name _; do
+    [[ -n $name ]] || continue
+    pkind=$(awk -F'\t' -v n="$name" '$2 == n { print $1; exit }' <<<"$published")
+    if [[ -n $pkind && $pkind != other && $kind != "$pkind" ]]; then
+      die "the local $name is a '$kind' package, but the published one is '$pkind'"
+    fi
+  done <<<"$fresh"
+  {
+    [[ -z $fresh ]] || printf '%s\n' "$fresh"
+    awk -F'\t' 'FNR == 1 { file++ } file == 1 { if ($2 != "") seen[$2] = 1; next } $2 != "" && !($2 in seen)' \
+      <(printf '%s\n' "$fresh") <(printf '%s\n' "$published")
+  } | awk -F'\t' '$1 == "kernel" || $1 == "dkms"' | sort -t$'\t' -k1,1 -k2,2
+}
+
+# The names a check is about: --local's, or those that move in from --from, or
+# with neither option every one.
+changed_names() {
+  local names
+  names=$(changed_unfiltered "$@")
+  if ((from_repos)); then
+    names=$ARCH_SOURCED
+  fi
+  if [[ -n $only ]]; then
+    # Keep a name when it, or its pkgbase, is one of --packages.
+    awk -F'\t' -v only=" $only " 'FNR == 1 { file++ } file == 1 { if ($1 != "") keep[$1] = 1; next }
+      ($2 in keep) && (index(only, " " $2 " ") || index(only, " " $7 " ")) { print $2 }' \
+      <(printf '%s\n' "$names") <(printf '%s\n' "$1")
+  else
+    printf '%s\n' "$names"
+  fi
+}
+
+changed_unfiltered() {
+  local packages=$1 fresh=$2
+  # A package taken from Arch never moves: it pairs through kernels. This
+  # repository's own copy of a repo= name is in its database, so it does.
+  if ((!all_pairs)) && [[ -n $fresh ]]; then
+    cut -f2 <<<"$fresh"
+  else
+    cut -f2 <<<"$packages"
+  fi
+}
+
+# Every published DKMS package must be in the registry; a listed one that this
+# channel does not publish is only noted.
+check_registry() {
+  local packages=$1 status=0 kind name
+  while IFS=$'\t' read -r kind name _; do
+    [[ $kind == dkms ]] || continue
+    if ! is_listed "$name"; then
+      echo "check-dkms: $name ships a DKMS module for $arch but is not in ci/dkms-packages" >&2
+      status=1
+    fi
+  done <<<"$packages"
+  while IFS= read -r name; do
+    [[ -n $name ]] || continue
+    from_repo "$name" && continue
+    awk -F'\t' -v n="$name" '$1 == "dkms" && $2 == n { f = 1 } END { exit !f }' <<<"$packages" ||
+      echo "check-dkms: note: $name is listed for $arch but not published here" >&2
+  done <<<"$LISTED"
+  return "$status"
+}
+
+# The packages with every kernel whose pkgbase KERNELS does not match left
+# out, and named on stderr.
+our_kernels() { # our_kernels <packages>
+  local kind name rest base
+  while IFS=$'\t' read -r kind name rest; do
+    [[ -n $name ]] || continue
+    if [[ $kind == kernel ]]; then
+      base=${rest##*$'\t'}
+      # Unquoted on purpose: KERNELS is a glob.
+      # shellcheck disable=SC2053
+      if [[ $base != $KERNELS ]]; then
+        echo "check-dkms: note: $name ($base) is not a kernel this check builds against ($KERNELS); left out" >&2
+        continue
+      fi
+    fi
+    printf '%s\t%s\t%s\n' "$kind" "$name" "$rest"
+  done <<<"$1"
+}
+
+# The kernel/module pairs to build: "<kernel name> <kver> <dkms name> <tree>".
+pairs() {
+  local packages=$1 changed=$2
+  awk -F'\t' '
+    FNR == 1 { file++ }
+    # kernels= names the headers a module builds against, or with a leading
+    # "!" the ones it never does; with only exclusions, every other kernel.
+    function builds_against(module, kernel,   n, s, x, listed, hit) {
+      if (!(module in scope)) return 1
+      n = split(scope[module], s, ",")
+      for (x = 1; x <= n; x++) {
+        if (substr(s[x], 1, 1) == "!") {
+          if (substr(s[x], 2) == kernel) return 0
+        } else {
+          listed = 1
+          if (s[x] == kernel) hit = 1
+        }
+      }
+      return !listed || hit
+    }
+    file == 1 { if ($1 != "") scope[$1] = $2; next }
+    file == 2 { if ($1 != "") c[$1] = 1; next }
+    $1 == "kernel" { kn[++k] = $2; kv[k] = $6; next }
+    $1 == "dkms" { dn[++d] = $2; dt[d] = $6 }
+    END {
+      for (i = 1; i <= d; i++) {
+        n = split(dt[i], t, ",")
+        for (j = 1; j <= k; j++)
+          if (((dn[i] in c) || (kn[j] in c)) && builds_against(dn[i], kn[j]))
+            for (x = 1; x <= n; x++) print kn[j] "\t" kv[j] "\t" dn[i] "\t" t[x]
+      }
+    }' <(printf '%s\n' "$SCOPES") <(printf '%s\n' "$changed") <(printf '%s\n' "$packages")
+}
+
+plan_for() { # plan_for <channel db> [--from's db]: sets PACKAGES, CHANGED, PAIRS
+  local fresh="" published incoming repos="" ours
+  PACKAGES="" CHANGED="" PAIRS=""
+  published=$(read_db "$1")
+  if [[ -n $local_dir ]]; then
+    fresh=$(read_local)
+    # Only matrix gets here with nothing built for this architecture.
+    [[ -n $fresh ]] || ((all_pairs)) || return 0
+  elif [[ -n ${2:-} ]]; then
+    # Read on a line of its own: a source database that cannot be read stops
+    # the check. It must never read as a promotion that moves nothing.
+    incoming=$(read_db "$2" "$FROM_PREFIX")
+    fresh=$(moving "$published" "$incoming")
+    # A promotion that moves nothing checks nothing, unless asked for more.
+    [[ -n $fresh ]] || ((all_pairs || from_repos)) || return 0
+  fi
+  if [[ -n $REPOS ]] && repos_needed "$published" "$fresh"; then
+    load_repo_dbs
+    repos=$(read_repos "$REPO_CHANNEL" "${repo_dbs[@]}")
+    # This repository's own copy, published or fresh, is what pacman installs.
+    ours=$(printf '%s\n%s\n' "$published" "$fresh" | awk -F'\t' '$1 == "dkms" { print $2 }')
+    repos=$(awk -F'\t' 'FNR == 1 { file++ } file == 1 { if ($0 != "") o[$0] = 1; next }
+      ($2 in o) { print "check-dkms: note: " $2 " is built here too; the Arch copy is not checked (drop its repo= from ci/dkms-packages)" > "/dev/stderr"; next } { print }' \
+      <(printf '%s\n' "$ours") <(printf '%s\n' "$repos"))
+    ARCH_SOURCED=$(awk -F'\t' '$1 == "dkms" { print $2 }' <<<"$repos")
+  fi
+  PACKAGES=$(compose "$(printf '%s\n%s\n' "$published" "$repos" | sed '/^$/d')" "$fresh")
+  # Listed DKMS packages, and every fresh one: a pull request that adds a new
+  # recipe is checked before it publishes, even though master's registry does
+  # not list it yet.
+  PACKAGES=$(awk -F'\t' 'FNR == 1 { file++ }
+    file == 1 { if ($0 != "") ok[$0] = 1; next }
+    file == 2 { if ($1 == "dkms") ok[$2] = 1; next }
+    $1 == "kernel" || ($1 == "dkms" && ($2 in ok))' \
+    <(printf '%s\n' "$LISTED") <(printf '%s\n' "$fresh") <(printf '%s\n' "$PACKAGES"))
+  PACKAGES=$(our_kernels "$PACKAGES")
+  if [[ -n $fresh ]]; then
+    awk -F'\t' -v L="$LISTED" 'BEGIN { n = split(L, l, "\n"); for (i = 1; i <= n; i++) ok[l[i]] = 1 }
+      $1 == "dkms" && !($2 in ok) { print "check-dkms: note: " $2 " is not in ci/dkms-packages yet; checking it against every kernel" > "/dev/stderr" }' <<<"$fresh"
+  fi
+  CHANGED=$(changed_names "$PACKAGES" "$fresh")
+  PAIRS=$(pairs "$PACKAGES" "$CHANGED")
+  # One leg of a matrix: the pairs of one kernel (headers name or pkgbase) and
+  # one DKMS package, at the versions the leg names, if it names them. A leg
+  # the plan no longer has means the channel moved after the matrix was made:
+  # fail, so the run is redone, not passed.
+  if [[ -n $pair_kernel || -n $pair_module ]]; then
+    PAIRS=$(awk -F'\t' -v k="$pair_kernel" -v m="$pair_module" 'FNR == 1 {
+        file++
+        split(k, kk, " "); split(m, mm, " ")
+      }
+      file == 1 { base[$2] = $7; ver[$2] = $3; next }
+      $1 != "" && (kk[1] == "" || $1 == kk[1] || base[$1] == kk[1]) && (kk[2] == "" || ver[$1] == kk[2]) &&
+        (mm[1] == "" || $3 == mm[1]) && (mm[2] == "" || ver[$3] == mm[2])' \
+      <(printf '%s\n' "$PACKAGES") <(printf '%s\n' "$PAIRS"))
+    [[ -n $PAIRS ]] || die "this plan has no pair${pair_kernel:+ for kernel $pair_kernel}${pair_module:+ and module $pair_module}; the channel moved since the matrix was made, so run it again"
+  fi
+}
+
+# The plan's legs as a JSON array: one per kernel (by pkgbase) and DKMS
+# package, each named with its version.
+legs() {
+  awk -F'\t' -v a="$arch" 'FNR == 1 { file++ }
+    file == 1 { base[$2] = $7; ver[$2] = $3; next }
+    $1 != "" && !seen[$1 "\t" $3]++ {
+      printf "%s{\"arch\":\"%s\",\"kernel\":\"%s %s\",\"module\":\"%s %s\"}", (n++ ? "," : "["), a, base[$1], ver[$1], $3, ver[$3]
+    }
+    END { print (n ? "]" : "[]") }' <(printf '%s\n' "$PACKAGES") <(printf '%s\n' "$PAIRS")
+}
+
+# The channel's files database, and --from's, into $work. What moves is
+# downloaded from --from's channel, so its file names become URLs there.
+download_channel() {
+  curl -fsSL --retry 3 -o "$work/channel.files" "$PKGS_BASE/$channel/$arch/omarchy.files" || die "cannot download $channel/$arch/omarchy.files"
+  files_db=$work/channel.files
+  if [[ -n $from ]]; then
+    [[ $from != "$channel" ]] || die "--from names the channel itself"
+    curl -fsSL --retry 3 -o "$work/from.files" "$PKGS_BASE/$from/$arch/omarchy.files" || die "cannot download $from/$arch/omarchy.files"
+    from_db=$work/from.files
+    FROM_PREFIX=$PKGS_BASE/$from/$arch/
+  fi
+}
+
+# repo= packages can only pair with a kernel. They are needed when every
+# package is checked, with --from-repos, or when a kernel is fresh or moves.
+repos_needed() { # repos_needed <published> <fresh or moving>
+  ((from_repos || all_pairs)) && return 0
+  [[ -n $2 ]] || return 0
+  awk -F'\t' '$1 == "kernel" { f = 1 } END { exit !f }' <<<"$2"
+}
+
+# plan reads the repo files databases it was given; run downloads them.
+load_repo_dbs() {
+  ((download)) || return 0
+  local repo
+  while IFS= read -r repo; do
+    [[ -n $repo ]] || continue
+    curl -fsSL --retry 3 -o "$work/$repo.files" "$(repo_url "$channel" "$repo")/$repo.files" ||
+      die "cannot download $repo.files from the $channel mirror"
+    repo_dbs+=("$repo=$work/$repo.files")
+  done < <(cut -f2 <<<"$REPOS" | sort -u)
+}
+
+# A leg's outcome, from run's exit status and its verdicts: the worst pair
+# decides it. The status must agree with the verdicts, and a run that stopped
+# (any other status, or no verdicts) is an error, never a pass.
+leg_result() { # leg_result <status> <pairs.tsv>
+  local status=$1 pairs=$2
+  [[ -f $pairs ]] || pairs=/dev/null
+  jq -n --arg arch "$arch" --arg kernel "$pair_kernel" --arg module "$pair_module" \
+    --argjson status "$status" --rawfile pairs "$pairs" '
+    def rank: {failed: 5, fixed: 4, "known-broken": 3, built: 2, excluded: 1}[.] // 0;
+    # The container wrote these rows: plain text only, and nothing else.
+    def plain: gsub("[^A-Za-z0-9 ._+~,;:()=/@#\u0027-]"; " ") | .[0:400];
+    ($pairs | split("\n") | map(select(length > 0) | split("\t"))) as $rows
+    | ($rows | map({tree: (.[3] // "" | plain), verdict: (.[4] // ""), text: (.[5] // "" | plain), fields: length})) as $p
+    | (if ($p | length) == 0 then "" else ($p | max_by(.verdict | rank) | .verdict) end) as $worst
+    | (if ($status != 0 and $status != 1) or ($p | length) == 0 then
+         {outcome: "error", detail: "the check stopped before it built anything (exit status \($status))"}
+       elif any($p[]; .fields != 6 or (.verdict | rank) == 0) then
+         {outcome: "error", detail: "the verdicts are malformed"}
+       elif ($status == 1) != ($worst == "failed" or $worst == "fixed") then
+         {outcome: "error", detail: "exit status \($status) disagrees with the verdicts"}
+       else
+         {outcome: (if $worst == "built" then "passed" else $worst end),
+          detail: (if ($p | length) == 1 then (if $p[0].text == "built" then "" else $p[0].text end)
+                   else ($p | map("\(.tree): \(.text)") | join("; ")) end)}
+       end)
+    | {arch: $arch, kernel: $kernel, module: $module} + .'
+}
+
+print_plan() {
+  awk -F'\t' '{ print $1 "\t" $2 "\t" $3 "\t" $6 }' <<<"$PACKAGES"
+  if [[ -n $PAIRS ]]; then
+    awk -F'\t' '{ print "pair\t" $1 " " $2 "\t" $3 " " $4 }' <<<"$PAIRS"
+  else
+    echo "nothing to check"
+  fi
+}
+
+case $mode in
+  matrix)
+    # The legs a CI run fans out into, each built by run --kernel --module.
+    # A build with nothing for this architecture has none; nothing to download.
+    # Read on a line of its own: a package that cannot be read or trusted
+    # stops here, never reads as an empty build.
+    local_rows=""
+    if [[ -n $local_dir ]]; then
+      local_rows=$(read_local)
+    fi
+    if [[ -n $local_dir && -z $local_rows ]] && ((!all_pairs)); then
+      echo "$arch: this build has nothing for $arch" >&2
+      echo '[]'
+      exit 0
+    fi
+    if ((download)); then
+      [[ -n $channel ]] || die "matrix needs --channel or --files-db"
+      work=$(mktemp -d)
+      trap 'rm -rf "$work"' EXIT
+      download_channel
+    fi
+    [[ -z $from_db || -f $from_db ]] || die "--from-db $from_db is not a file"
+    check_registry "$(read_db "$files_db")" || exit 1
+    plan_for "$files_db" "$from_db"
+    if [[ -n $PAIRS ]]; then
+      print_plan >&2
+    else
+      echo "$arch: nothing to check" >&2
+    fi
+    if [[ -n $save_local ]]; then
+      [[ -n $local_dir ]] || die "--save-local needs --local"
+      mkdir -p "$save_local"
+      while IFS=$'\t' read -r kind _ _ file _; do
+        [[ $kind == kernel || $kind == dkms ]] || continue
+        cp -- "$file" "$save_local/" || die "cannot copy ${file##*/} to $save_local"
+      done <<<"$local_rows"
+    fi
+    legs
+    ;;
+
+  plan)
+    [[ -f $files_db ]] || die "plan needs --files-db"
+    [[ -z $from_db || -f $from_db ]] || die "--from-db $from_db is not a file"
+    all=$(read_db "$files_db")
+    status=0
+    check_registry "$all" || status=1
+    plan_for "$files_db" "$from_db"
+    print_plan
+    exit "$status"
+    ;;
+
+  container)
+    [[ -n $channel ]] || die "container needs --channel"
+    image=$X86_64_IMAGE
+    [[ $arch == x86_64 ]] || image=$AARCH64_IMAGE
+    mounts=(-v "$ROOT:/src:ro")
+    args=(run --arch "$arch" --channel "$channel")
+    [[ -z $from ]] || args+=(--from "$from")
+    [[ -z $only ]] || args+=(--packages "$only")
+    ((!from_repos)) || args+=(--from-repos)
+    ((!all_pairs)) || args+=(--all)
+    [[ -z $pair_kernel ]] || args+=(--kernel "$pair_kernel")
+    [[ -z $pair_module ]] || args+=(--module "$pair_module")
+    if [[ -n $local_dir ]]; then
+      mounts+=(-v "$(realpath "$local_dir"):/local:ro")
+      args+=(--local /local)
+    fi
+    # run writes each pair's verdict here; the outcome is decided out here.
+    results=$(mktemp -d)
+    trap 'rm -rf "$results"' EXIT
+    mounts+=(-v "$results:/results")
+    args+=(--results /results)
+    if [[ -n ${GITHUB_STEP_SUMMARY:-} ]]; then
+      mounts+=(-v "$GITHUB_STEP_SUMMARY:/summary.md")
+      args=(env GITHUB_STEP_SUMMARY=/summary.md bash /src/bin/check-dkms "${args[@]}")
+    else
+      args=(bash /src/bin/check-dkms "${args[@]}")
+    fi
+    # The container runs a pull request's code: its kernel's and modules'
+    # Makefiles. Nothing they print may act as a workflow command on the
+    # runner (::add-mask::, ::set-output::, ::error::).
+    stop=""
+    if [[ -n ${GITHUB_ACTIONS:-} ]]; then
+      stop=$(od -An -N16 -tx1 /dev/urandom | tr -d ' \n')
+      echo "::stop-commands::$stop"
+    fi
+    status=0
+    # run reads these from the environment. It gets the values used out here,
+    # so the container plans the same legs the matrix planned.
+    envs=(-e "OMARCHY_DKMS_KERNELS=$KERNELS" -e "OMARCHY_PKGS_BASE=$PKGS_BASE")
+    docker run --rm "${envs[@]}" "${mounts[@]}" "$image" "${args[@]}" || status=$?
+    outcome=$(leg_result "$status" "$results/pairs.tsv") || die "cannot summarise the leg"
+    # Still inside stop-commands: the detail is the container's text.
+    echo "==> $(jq -r '"\(.outcome)\(if .detail == "" then "" else ": " + .detail end)"' <<<"$outcome")"
+    [[ -z $stop ]] || echo "::$stop::"
+    if [[ -n $result_file ]]; then
+      printf '%s\n' "$outcome" >"$result_file" || die "cannot write $result_file"
+    fi
+    case $(jq -r .outcome <<<"$outcome") in
+      passed | excluded | known-broken) exit 0 ;;
+      *) exit 1 ;;
+    esac
+    ;;
+
+  run)
+    [[ -n $channel ]] || die "run needs --channel"
+    ((EUID == 0)) || die "run installs packages; run it as root in a disposable system"
+    work=$(mktemp -d)
+    download_channel
+    check_registry "$(read_db "$files_db")" || exit 1
+    plan_for "$files_db" "$from_db"
+    echo "==> $channel/$arch${from:+, with what moves in from $from}${local_dir:+, with $local_dir}${pair_kernel:+, kernel $pair_kernel}${pair_module:+, module $pair_module}:"
+    print_plan | column -t -s $'\t'
+    if [[ -z $PAIRS ]]; then
+      echo "### DKMS on $channel/$arch: nothing to check" | tee -a "${GITHUB_STEP_SUMMARY:-/dev/null}"
+      exit 0
+    fi
+
+    # The Arch packages the channel's machines build with: its own mirror
+    # snapshot (mirror_server). pacman 7 cannot sandbox its downloads on a
+    # kernel without Landlock, which CI runners can be.
+    echo "Server = $(mirror_server "$channel")" >/etc/pacman.d/mirrorlist
+    if [[ $arch == aarch64 ]]; then
+      pacman-key --init >/dev/null 2>&1
+      pacman-key --populate archlinuxarm >/dev/null 2>&1
+    fi
+    if ! grep -qw landlock /sys/kernel/security/lsm 2>/dev/null && ! grep -q '^DisableSandbox' /etc/pacman.conf; then
+      sed -i '/^\[options\]/a DisableSandboxFilesystem\nDisableSandboxSyscalls' /etc/pacman.conf
+    fi
+    pacman -Syu --noconfirm --needed dkms base-devel bc cpio pahole libarchive curl >/dev/null
+
+    # Sets FETCHED to a verified local copy of a package line's file.
+    fetch() {
+      local file=$1 sha=$2
+      if [[ $sha == - ]]; then
+        FETCHED=$file
+        return 0
+      fi
+      # repo= packages, and what moves in from --from, carry their URL; the
+      # channel's own, a file name.
+      local url=$PKGS_BASE/$channel/$arch/$file
+      [[ $file != *://* ]] || url=$file
+      FETCHED=$work/${file##*/}
+      curl -fsSL --retry 3 -o "$FETCHED" "$url" || die "cannot download $url"
+      echo "$sha  $FETCHED" | sha256sum -c --quiet - || die "$file does not match its database's SHA-256"
+    }
+    line_of() { awk -F'\t' -v n="$1" '$2 == n' <<<"$PACKAGES"; }
+
+    for name in $(cut -f1 <<<"$PAIRS" | sort -u); do
+      IFS=$'\t' read -r _ _ _ file sha kver _ <<<"$(line_of "$name")"
+      fetch "$file" "$sha"
+      echo "==> Installing $name ($kver)"
+      pacman -U --noconfirm --needed "$FETCHED" >/dev/null || die "cannot install $name"
+    done
+    # A kernel built with clang needs clang, lld and the llvm tools on PATH.
+    # Its headers package should depend on them; when it does not, a machine
+    # without them cannot build any module for that kernel, so say so.
+    llvm_kernels=() llvm_note=""
+    for kver in $(cut -f2 <<<"$PAIRS" | sort -u); do
+      [[ -z $(toolchain "/usr/lib/modules/$kver/build") ]] || llvm_kernels+=("$kver")
+    done
+    if ((${#llvm_kernels[@]})); then
+      missing=()
+      for tool in clang ld.lld llvm-ar llvm-nm llvm-objcopy; do
+        command -v "$tool" >/dev/null || missing+=("$tool")
+      done
+      if ((${#missing[@]})); then
+        echo "==> ${llvm_kernels[*]}: built with clang; installing clang, llvm and lld (missing: ${missing[*]})"
+        pacman -S --noconfirm --needed clang llvm lld >/dev/null || die "cannot install clang, llvm and lld"
+        llvm_note="the kernel's headers do not depend on clang, llvm and lld; the check installed them"
+      fi
+      echo "==> $(clang --version | head -n 1), for ${llvm_kernels[*]}"
+    fi
+    # DKMS packages are unpacked, not installed: pacman would run DKMS's own
+    # hook and build them against every kernel. The whole package, not just
+    # /usr/src: broadcom-wl's build links a blob from /usr/lib/broadcom-wl-dkms.
+    for name in $(cut -f3 <<<"$PAIRS" | sort -u); do
+      IFS=$'\t' read -r _ _ _ file sha _ <<<"$(line_of "$name")"
+      fetch "$file" "$sha"
+      bsdtar -xpf "$FETCHED" -C / --exclude .PKGINFO --exclude .BUILDINFO --exclude .MTREE \
+        --exclude .INSTALL --exclude .CHANGELOG || die "cannot unpack $name"
+    done
+
+    raw=""
+    while IFS=$'\t' read -r kname kver dname tree; do
+      # The module and version the way Arch's DKMS hook reads them: the source
+      # directory's name, split at its last dash.
+      module=${tree%-*} version=${tree##*-}
+      dkms add -m "$module" -v "$version" >/dev/null 2>&1 || true
+      echo "==> $dname: $module/$version against $kver"
+      status=0
+      timeout 3600 dkms build --force -m "$module" -v "$version" -k "$kver" >"$work/build.log" 2>&1 || status=$?
+      case $status in
+        0) result=built ;;
+        77) result=excluded ;;
+        *)
+          result=failed
+          tail -n 40 "$work/build.log" || true
+          log=/var/lib/dkms/$module/$version/build/make.log
+          if [[ -f $log ]]; then
+            # The compiler's errors, then the end of the log: a link or
+            # modpost failure names no "error" until make gives up.
+            echo "--- $log (errors)"
+            grep -m 20 -iE 'error|undefined|no rule|fatal' "$log" || true
+            echo "--- $log (end)"
+            tail -n 25 "$log" || true
+          fi
+          ;;
+      esac
+      note=-
+      if [[ -n $llvm_note && " ${llvm_kernels[*]} " == *" $kver "* ]]; then
+        note=$llvm_note
+      fi
+      echo "    $result"
+      raw+=$(printf '%s\t%s\t%s\t%s\t%s\t%s' "$kname" "$kver" "$dname" "$tree" "$result" "$note")$'\n'
+    done <<<"$PAIRS"
+
+    failed=0
+    judged=$(judge <<<"$raw") || failed=$?
+    ((failed < 2)) || die "cannot judge the results"
+    if [[ -n $results_dir ]]; then
+      printf '%s\n' "$judged" >"$results_dir/pairs.tsv" || die "cannot write $results_dir/pairs.tsv"
+    fi
+    {
+      echo "### DKMS on $channel/$arch${from:+, with what moves in from $from}${local_dir:+, with this build}"
+      echo
+      echo "| Package | Module | Kernel | Result |"
+      echo "|---|---|---|---|"
+      awk -F'\t' '{ m = $4; sub(/-[^-]*$/, "", m); v = substr($4, length(m) + 2); print "| " $3 " | " m " " v " | " $1 " " $2 " | " $6 " |" }' <<<"$judged"
+    } | tee -a "${GITHUB_STEP_SUMMARY:-/dev/null}"
+    exit "$failed"
+    ;;
+
+  judge)
+    judge
+    ;;
+
+  *) usage ;;
+esac
diff --git a/ci/dkms-packages b/ci/dkms-packages
new file mode 100644
index 0000000000..1f77ef2dc0
--- /dev/null
+++ b/ci/dkms-packages
@@ -0,0 +1,45 @@
+# Every DKMS package this repository publishes, and the architectures
+# bin/check-dkms builds it for against the kernels' headers. check-dkms fails
+# when a channel publishes a DKMS source tree for a package that is not listed
+# here, so a new DKMS recipe cannot slip past the gate.
+#
+# The kernels are Omarchy's own, linux-omarchy* (KERNELS in bin/check-dkms).
+# A module limited to another kernel stays listed here, but nothing builds it.
+#
+# kernels= limits a module to the kernel headers packages it is installed
+# with: the Apple modules only ever run on the Asahi kernel, linux-aurora.
+# kernels=!<headers>,... builds it against every kernel but those: no Apple
+# Silicon Mac has an NVIDIA GPU, but every other aarch64 kernel can drive one.
+#
+# repo=<name> marks a DKMS package Omarchy installs from an Arch (aarch64:
+# Arch Linux ARM) repository instead of building it here. check-dkms reads it
+# from the channel's mirror and builds it whenever a kernel changes, and the
+# daily run builds it when the mirror updates it. A repository that publishes
+# the same name itself is what pacman installs, so its copy is checked instead.
+#
+# known-broken="<why>" marks a package that does not build and that we keep
+# shipping for now. Its failures are reported as known broken, not as
+# failures; a pair that builds fails the check, so the mark comes off as soon
+# as it is wrong.
+#
+# package                              architectures [kernels=[!]<headers>,...] [repo=<repo>] [known-broken="<why>"]
+brcmfmac-awdl-dkms                     aarch64 kernels=linux-aurora-headers
+intel-ipu7-camera                      x86_64
+macbook12-spi-driver-dkms              x86_64 known-broken="does not build since Linux 6.10 and upstream stopped in 2024; the in-tree applespi drives the keyboard and touchpad"
+macbook8-spi-pxa2xx-nodma-dkms         x86_64
+nvidia-580xx-dkms                      x86_64
+nvidia-open-dkms                       aarch64 kernels=!linux-aurora-headers
+omarchy-ane-dkms                       aarch64 kernels=linux-aurora-headers
+spark-hwmon-dkms                       aarch64 kernels=!linux-aurora-headers
+thinkpad-t14-amd-touchpad-dkms         x86_64
+tuxedo-drivers-nocompatcheck-dkms      x86_64
+xpadneo-dkms                           x86_64 aarch64
+yt6801-dkms                            x86_64
+
+# From Arch's repositories:
+#   nvidia-open-dkms   install/hardware/nvidia.sh in omacom/omarchy (aarch64 builds its own, above)
+#   v4l2loopback-dkms  intel-ipu7-camera's dependency, and the Cam Link 4K fix
+#   broadcom-wl-dkms   install/hardware/fix-bcm43xx.sh
+nvidia-open-dkms                       x86_64 repo=extra
+v4l2loopback-dkms                      x86_64 aarch64 repo=extra
+broadcom-wl-dkms                       x86_64 repo=extra
diff --git a/tests/build-artifacts.sh b/tests/build-artifacts.sh
new file mode 100755
index 0000000000..88e19f40ee
--- /dev/null
+++ b/tests/build-artifacts.sh
@@ -0,0 +1,259 @@
+#!/bin/bash
+# Self-test for bin/build-artifacts: what a pull request build would publish,
+# for the DKMS check, as the build's dkms-request artifact records it. A
+# planned package with no artifact in the run built nothing (edge already
+# holds it); a reused artifact must still exist; a download, extraction or
+# copy that fails, an artifact with no package, or a missing or malformed
+# request fails the collection. gh is a stub that answers from fixtures.
+set -euo pipefail
+ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
+pass() { echo "PASS: $1"; }
+fail() { echo "FAIL: $1"; exit 1; }
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+# A head commit with three recipes.
+git init -q "$tmp/repo"
+for p in linux-omarchy xpadneo-dkms hyprland; do
+  mkdir -p "$tmp/repo/pkgbuilds/$p"
+  echo "pkgname=$p" >"$tmp/repo/pkgbuilds/$p/PKGBUILD"
+done
+git -C "$tmp/repo" add -A
+git -C "$tmp/repo" -c user.name=t -c user.email=t@t commit -qm head
+head=$(git -C "$tmp/repo" rev-parse HEAD)
+tree() { git -C "$tmp/repo" rev-parse "$head:pkgbuilds/$1"; }
+
+# gh api, answered from $FAKE_GH: runs/<id>.json (a run's artifacts),
+# artifacts/<id>.zip, named/<label>.json, runinfo/<id>.json (a run),
+# compare/<sha>.json and blob/<ref>.json (build-pr.yml at a commit; a 404 the
+# way gh reports one when absent). --jq applies the expression the way gh does.
+mkdir -p "$tmp/bin" "$tmp/gh/runs" "$tmp/gh/artifacts" "$tmp/gh/named" "$tmp/gh/runinfo" "$tmp/gh/compare" "$tmp/gh/blob"
+cat >"$tmp/bin/gh" <<'GH'
+#!/bin/bash
+set -euo pipefail
+path="" expr="" paginate=0
+while (($#)); do
+  case $1 in
+    --jq) expr=$2; shift 2 ;;
+    --paginate) paginate=1; shift ;;
+    repos/*) path=$1; shift ;;
+    *) shift ;;
+  esac
+done
+case $path in
+  */actions/runs/*/artifacts) file=$FAKE_GH/runs/$(cut -d/ -f6 <<<"$path").json ;;
+  */actions/artifacts/*/zip) cat "$FAKE_GH/artifacts/$(cut -d/ -f6 <<<"$path").zip"; exit ;;
+  */actions/artifacts\?name=*)
+    # Pages the way GitHub does: per_page (default 30) at a time, every page
+    # with --paginate, else the first.
+    label=${path#*name=}; file=$FAKE_GH/named/${label%%&*}.json
+    [[ -f $file ]] || { echo "gh stub: HTTP 404" >&2; exit 1; }
+    per=30; [[ $path != *per_page=* ]] || per=${path##*per_page=}; per=${per%%&*}
+    page=0
+    while :; do
+      chunk=$(jq -c --argjson p "$page" --argjson n "$per" '{artifacts: .artifacts[$p * $n:($p + 1) * $n]}' "$file")
+      [[ $page == 0 || $(jq '.artifacts | length' <<<"$chunk") -gt 0 ]] || break
+      if [[ -n $expr ]]; then jq -r "$expr" <<<"$chunk"; else echo "$chunk"; fi
+      ((paginate)) || break
+      page=$((page + 1))
+    done
+    exit ;;
+  */actions/runs/*) file=$FAKE_GH/runinfo/$(cut -d/ -f6 <<<"$path").json ;;
+  */compare/*...*) file=$FAKE_GH/compare/${path##*...}.json ;;
+  */contents/.github/workflows/build-pr.yml\?ref=*)
+    ref=${path#*ref=}
+    [[ ! -f $FAKE_GH/blob/$ref.error ]] || { echo "gh: Server Error (HTTP 502)" >&2; exit 1; }
+    file=$FAKE_GH/blob/$ref.json
+    [[ -f $file ]] || { echo '{"message":"Not Found"}'; echo "gh: Not Found (HTTP 404)" >&2; exit 1; } ;;
+  *) echo "gh stub: unexpected $path" >&2; exit 1 ;;
+esac
+[[ -f $file ]] || { echo "gh stub: HTTP 404" >&2; exit 1; }
+if [[ -n $expr ]]; then jq -r "$expr" "$file"; else cat "$file"; fi
+GH
+chmod +x "$tmp/bin/gh"
+export PATH="$tmp/bin:$PATH" FAKE_GH="$tmp/gh" GITHUB_REPOSITORY=omacom/omarchy-pkgs
+
+# artifact <id> <tar|bare|empty|corrupt> <file>...: an artifact's zip.
+artifact() {
+  local id=$1 form=$2 dir="$tmp/a$1" f
+  mkdir -p "$dir/files" "$dir/zip"
+  for f in "${@:3}"; do echo "$f" >"$dir/files/$f"; done
+  case $form in
+    tar) tar -cf "$dir/zip/packages.tar" -C "$dir/files" "${@:3}" ;;
+    bare) cp "$dir/files"/* "$dir/zip/" ;;
+    empty) tar -cf "$dir/zip/packages.tar" -T /dev/null ;;
+    corrupt) echo "not a tar" >"$dir/zip/packages.tar" ;;
+  esac
+  (cd "$dir/zip" && bsdtar -a -cf "$tmp/gh/artifacts/$id.zip" ./*)
+}
+artifact 11 tar linux-omarchy-7.2.8-10-x86_64.pkg.tar.zst linux-omarchy-headers-7.2.8-10-x86_64.pkg.tar.zst
+artifact 12 bare xpadneo-dkms-0.9.8-1-any.pkg.tar.zst
+artifact 13 empty
+artifact 14 corrupt
+artifact 15 tar 'linux-omarchy-1:7.2.8-10-aarch64.pkg.tar.zst'
+
+run_json() { # run_json <run> <name=id>...: a run's artifact listing
+  local pair
+  for pair in "${@:2}"; do
+    jq -n --arg n "${pair%=*}" --argjson i "${pair#*=}" '{name: $n, id: $i, expired: false}'
+  done | jq -s '{artifacts: .}' >"$tmp/gh/runs/$1.json"
+}
+matrix() { # matrix <package:arch>...
+  printf '%s\n' "$@" | jq -Rsc 'split("\n") | map(select(length > 0) | split(":") | {package: .[0], arch: .[1]}) | {include: .}'
+}
+request() { # request <run> <request json>: the run's dkms-request artifact, replacing any
+  mkdir -p "$tmp/req$1"
+  printf '%s\n' "$2" >"$tmp/req$1/dkms-request.json"
+  (cd "$tmp/req$1" && bsdtar -a -cf "$tmp/gh/artifacts/90$1.zip" dkms-request.json)
+  [[ -f $tmp/gh/runs/$1.json ]] || echo '{"artifacts": []}' >"$tmp/gh/runs/$1.json"
+  jq --argjson i "90$1" '.artifacts = [.artifacts[] | select(.name != "dkms-request")] + [{name: "dkms-request", id: $i, expired: false}]' \
+    "$tmp/gh/runs/$1.json" >"$tmp/listing" && mv "$tmp/listing" "$tmp/gh/runs/$1.json"
+}
+collect() { # collect <run> <matrix> <reused json> [trusted]
+  rm -rf "$tmp/out"
+  request "$1" "$(jq -n --argjson m "$2" --argjson r "$3" --argjson t "${4:-true}" '{trusted: $t, matrix: $m, reused: $r}')"
+  (cd "$tmp/repo" && "$ROOT/bin/build-artifacts" "$tmp/out" "$1" "$head") >"$tmp/stdout" 2>"$tmp/stderr"
+}
+outfiles() { ls "$tmp/out" 2>/dev/null | sort | tr '\n' ' '; }
+
+k=linux-omarchy-x86_64-$(tree linux-omarchy)
+run_json 1 "$k=11" "hyprland-x86_64-$(tree linux-omarchy)=12"
+collect 1 "$(matrix linux-omarchy:x86_64 hyprland:x86_64)" '[]' || fail "a run's own artifacts collect: $(cat "$tmp/stderr")"
+[[ $(outfiles) == "linux-omarchy-7.2.8-10-x86_64.pkg.tar.zst linux-omarchy-headers-7.2.8-10-x86_64.pkg.tar.zst " ]] &&
+  pass "a planned package's artifact from this run is unpacked, and only by its own label" || fail "own: $(outfiles)"
+grep -qF "hyprland-x86_64-$(tree hyprland): nothing built (edge already holds this version)" "$tmp/stdout" &&
+  pass "a planned package with no artifact in the run built nothing" || fail "held: $(cat "$tmp/stdout")"
+
+x=xpadneo-dkms-x86_64-$(tree xpadneo-dkms)
+# A run that may vouch for an artifact: this repository's build-pr.yml.
+runinfo() { # runinfo <id> <head repository> [path] [event] [head sha]
+  jq -n --arg r "$2" --arg p "${3:-.github/workflows/build-pr.yml}" --arg e "${4:-pull_request}" --arg s "${5:-$head}" \
+    '{path: $p, event: $e, head_repository: {full_name: $r}, head_sha: $s}' >"$tmp/gh/runinfo/$1.json"
+}
+runinfo 501 omacom/omarchy-pkgs
+jq -n --arg n "$x" '{artifacts: [{name: $n, id: 99, expired: true, created_at: "2026-10-18T10:00:00Z", workflow_run: {id: 501}}, {name: $n, id: 12, expired: false, created_at: "2026-10-17T10:00:00Z", workflow_run: {id: 501}}]}' >"$tmp/gh/named/$x.json"
+collect 1 "$(matrix linux-omarchy:x86_64)" "[\"$x\"]" || fail "a reused artifact collects: $(cat "$tmp/stderr")"
+grep -q '^xpadneo-dkms-0.9.8-1-any.pkg.tar.zst$' <(ls "$tmp/out") &&
+  pass "a reused artifact from an earlier run is collected too, past an expired one, bare files included" || fail "reused: $(outfiles)"
+
+gone=linux-omarchy-aarch64-$(tree linux-omarchy)
+echo '{"artifacts": []}' >"$tmp/gh/named/$gone.json"
+! collect 1 "$(matrix)" "[\"$gone\"]" && grep -q "reused artifact $gone, which no longer exists" "$tmp/stderr" &&
+  pass "a reused artifact that is gone fails, it does not pass as nothing built" || fail "gone: $(cat "$tmp/stderr")"
+
+jq -n --arg n "$gone" '{artifacts: [{name: $n, id: 15, expired: false, created_at: "2026-10-18T10:00:00Z", workflow_run: {id: 501}}]}' >"$tmp/gh/named/$gone.json"
+collect 1 "$(matrix)" "[\"$gone\"]" && [[ -f "$tmp/out/linux-omarchy-1:7.2.8-10-aarch64.pkg.tar.zst" ]] &&
+  pass "a package with an epoch comes through packages.tar under its own name" || fail "epoch: $(outfiles) $(cat "$tmp/stderr")"
+
+run_json 2 "$k=13"
+! collect 2 "$(matrix linux-omarchy:x86_64)" '[]' && grep -q "artifact $k holds no package" "$tmp/stderr" &&
+  pass "an artifact with no package fails" || fail "empty: $(cat "$tmp/stderr")"
+run_json 3 "$k=14"
+! collect 3 "$(matrix linux-omarchy:x86_64)" '[]' && grep -q "cannot unpack artifact $k" "$tmp/stderr" &&
+  pass "an artifact whose packages.tar does not unpack fails" || fail "corrupt: $(cat "$tmp/stderr")"
+run_json 4 "$k=404"
+! collect 4 "$(matrix linux-omarchy:x86_64)" '[]' && grep -q "cannot download artifact $k" "$tmp/stderr" &&
+  pass "a download that fails fails the collection" || fail "download: $(cat "$tmp/stderr")"
+! (cd "$tmp/repo" && "$ROOT/bin/build-artifacts" "$tmp/out" 5 "$head") 2>"$tmp/stderr" && grep -q "cannot list run 5's artifacts" "$tmp/stderr" &&
+  pass "a run whose artifacts cannot be listed fails" || fail "listing: $(cat "$tmp/stderr")"
+! collect 1 "$(matrix no-such-recipe:x86_64)" '[]' && grep -q "no pkgbuilds/no-such-recipe at $head" "$tmp/stderr" &&
+  pass "a planned package missing from the head fails" || fail "recipe: $(cat "$tmp/stderr")"
+
+# A copy that fails stops the collection, it does not leave a package out.
+mkdir -p "$tmp/ro"
+chmod a-w "$tmp/ro"
+if [[ $(id -u) != 0 ]]; then
+  request 1 "$(jq -n --argjson m "$(matrix linux-omarchy:x86_64)" '{trusted: true, matrix: $m, reused: []}')"
+  ! (cd "$tmp/repo" && "$ROOT/bin/build-artifacts" "$tmp/ro" 1 "$head") 2>"$tmp/stderr" &&
+    grep -q "cannot copy linux-omarchy-.* from artifact $k" "$tmp/stderr" &&
+    pass "a package that cannot be copied fails the collection" || fail "copy: $(cat "$tmp/stderr")"
+fi
+chmod u+w "$tmp/ro"
+
+# The request: a pull request's run wrote it, so its shape is checked first.
+run_json 6 "$k=11"
+! (cd "$tmp/repo" && "$ROOT/bin/build-artifacts" "$tmp/out" 6 "$head") 2>"$tmp/stderr" && grep -q "run 6 has no dkms-request artifact" "$tmp/stderr" &&
+  pass "a run without a dkms-request fails, it does not pass as nothing built" || fail "no request: $(cat "$tmp/stderr")"
+collect 6 "$(matrix linux-omarchy:x86_64)" '[]' false && [[ -z $(outfiles) ]] && grep -q 'was not approved, so it built nothing' "$tmp/stdout" &&
+  pass "an untrusted build ships nothing" || fail "untrusted: $(outfiles) $(cat "$tmp/stderr")"
+for bad in '{"trusted": true, "matrix": {"include": [{"package": "../etc", "arch": "x86_64"}]}, "reused": []}' \
+  '{"trusted": true, "matrix": {"include": [{"package": "linux-omarchy", "arch": "x86_64?x=1"}]}, "reused": []}' \
+  '{"trusted": true, "matrix": {"include": []}, "reused": ["a&name=b-x86_64-0000000000000000000000000000000000000000"]}' \
+  '{"trusted": "yes", "matrix": {"include": []}, "reused": []}' 'not json' \
+  '{"trusted": true, "matrix": {"include": [{"package": "linux-omarchy\n", "arch": "x86_64"}]}, "reused": []}'; do
+  request 6 "$bad"
+  if (cd "$tmp/repo" && "$ROOT/bin/build-artifacts" "$tmp/out" 6 "$head") 2>"$tmp/stderr" >/dev/null; then fail "a malformed request must fail: $bad"; fi
+  grep -q "run 6's dkms-request is malformed" "$tmp/stderr" || fail "malformed: $bad: $(cat "$tmp/stderr")"
+done
+pass "a request with a path, a query or a wrong type in it fails before it names anything"
+
+# A package that is a link would copy whatever it points at on the runner.
+mkdir -p "$tmp/a16/zip"
+ln -s /etc/hostname "$tmp/a16/leak-1-1-x86_64.pkg.tar.zst"
+tar -cf "$tmp/a16/zip/packages.tar" -C "$tmp/a16" leak-1-1-x86_64.pkg.tar.zst
+(cd "$tmp/a16/zip" && bsdtar -a -cf "$tmp/gh/artifacts/16.zip" packages.tar)
+run_json 7 "$k=16"
+! collect 7 "$(matrix linux-omarchy:x86_64)" '[]' && grep -q "holds leak-1-1-x86_64.pkg.tar.zst, which is not a regular file" "$tmp/stderr" &&
+  [[ -z $(outfiles) ]] && pass "a package that is a link fails, it is not followed" || fail "link: $(outfiles) $(cat "$tmp/stderr")"
+
+# A file name with a tab or "##[" would reach plans and logs.
+mkdir -p "$tmp/a17/files" "$tmp/a17/zip"
+echo x >"$tmp/a17/files/evil"$'\t'"##[add-mask]x-1-1-x86_64.pkg.tar.zst"
+tar -cf "$tmp/a17/zip/packages.tar" -C "$tmp/a17/files" .
+(cd "$tmp/a17/zip" && bsdtar -a -cf "$tmp/gh/artifacts/17.zip" packages.tar)
+run_json 8 "$k=17"
+! collect 8 "$(matrix linux-omarchy:x86_64)" '[]' && grep -q "holds a file whose name makepkg would not produce" "$tmp/stderr" &&
+  ! grep -qF '##[' "$tmp/stderr" "$tmp/stdout" && pass "a package file name outside makepkg's rules fails, and is not repeated" || fail "file name: $(cat "$tmp/stderr")"
+
+# A reused artifact is only as good as the run that made it: anyone's run can
+# upload one under any name. Only this repository's build-pr.yml vouches, and
+# a fork's run only when its build-pr.yml is its merge base's.
+fork_sha=1111111111111111111111111111111111111111 base_sha=2222222222222222222222222222222222222222
+echo "{\"merge_base_commit\": {\"sha\": \"$base_sha\"}}" >"$tmp/gh/compare/$fork_sha.json"
+reuse() { # reuse <label> <artifact id:run id>...: the label's artifacts, newest first
+  local pair list='[]' n=0
+  for pair in "${@:2}"; do
+    list=$(jq -c --arg l "$1" --argjson a "${pair%%:*}" --argjson r "${pair#*:}" --arg t "$(printf '2026-10-18T%02d:%02d:00Z' $((11 - n / 60)) $((59 - n % 60)))" \
+      '. + [{name: $l, id: $a, expired: false, created_at: $t, workflow_run: {id: $r}}]' <<<"$list")
+    n=$((n + 1))
+  done
+  jq -n --argjson a "$list" '{artifacts: $a}' >"$tmp/gh/named/$1.json"
+}
+r=xpadneo-dkms-x86_64-$(tree xpadneo-dkms)
+runinfo 601 attacker/omarchy-pkgs .github/workflows/build-pr.yml pull_request "$fork_sha"
+echo '{"sha": "aaaa000000000000000000000000000000000001"}' >"$tmp/gh/blob/$base_sha.json"
+echo '{"sha": "bbbb000000000000000000000000000000000002"}' >"$tmp/gh/blob/$fork_sha.json"
+artifact 18 bare xpadneo-dkms-6.6.6-1-any.pkg.tar.zst
+reuse "$r" 18:601 12:501
+DEFAULT_BRANCH=master collect 1 "$(matrix)" "[\"$r\"]" && [[ $(outfiles) == "xpadneo-dkms-0.9.8-1-any.pkg.tar.zst " ]] &&
+  grep -q "run 601 cannot vouch" "$tmp/stdout" && pass "a fork's artifact whose build-pr.yml differs from its merge base is passed over for an older trusted one" ||
+  fail "fork changed: $(outfiles) / $(cat "$tmp/stdout" "$tmp/stderr")"
+reuse "$r" 12:601
+! DEFAULT_BRANCH=master collect 1 "$(matrix)" "[\"$r\"]" && grep -q "no artifact $r comes from a build this check trusts" "$tmp/stderr" &&
+  pass "a reused artifact that only an untrusted run vouches for fails" || fail "only untrusted: $(cat "$tmp/stderr")"
+runinfo 602 omacom/omarchy-pkgs .github/workflows/evil.yml pull_request
+reuse "$r" 12:602
+! DEFAULT_BRANCH=master collect 1 "$(matrix)" "[\"$r\"]" && grep -q "no artifact $r comes from a build this check trusts" "$tmp/stderr" &&
+  pass "an artifact from another workflow fails, whoever ran it" || fail "other workflow: $(cat "$tmp/stderr")"
+cp "$tmp/gh/blob/$base_sha.json" "$tmp/gh/blob/$fork_sha.json"
+reuse "$r" 12:601
+DEFAULT_BRANCH=master collect 1 "$(matrix)" "[\"$r\"]" && grep -q '^xpadneo-dkms-0.9.8-1-any.pkg.tar.zst$' <(ls "$tmp/out") &&
+  pass "a fork's artifact whose build-pr.yml is its merge base's is reused" || fail "fork unchanged: $(cat "$tmp/stderr")"
+rm "$tmp/gh/blob/$base_sha.json" "$tmp/gh/blob/$fork_sha.json"
+DEFAULT_BRANCH=master collect 1 "$(matrix)" "[\"$r\"]" && grep -q '^xpadneo-dkms-0.9.8-1-any.pkg.tar.zst$' <(ls "$tmp/out") &&
+  pass "a fork that branched before build-pr.yml existed is trusted (missing at both ends)" || fail "fork missing: $(cat "$tmp/stderr")"
+# However many untrusted artifacts come first, every page is read: 120 of
+# them fill more than the 100 a page holds.
+pairs=()
+for _ in $(seq 1 120); do pairs+=("18:601"); done
+reuse "$r" "${pairs[@]}" 12:501
+echo '{"sha": "aaaa000000000000000000000000000000000001"}' >"$tmp/gh/blob/$base_sha.json"
+echo '{"sha": "bbbb000000000000000000000000000000000002"}' >"$tmp/gh/blob/$fork_sha.json"
+DEFAULT_BRANCH=master collect 1 "$(matrix)" "[\"$r\"]" && [[ $(outfiles) == "xpadneo-dkms-0.9.8-1-any.pkg.tar.zst " ]] &&
+  pass "a trusted artifact behind a page of untrusted ones is still found" || fail "pages: $(outfiles) / $(tail -n 3 "$tmp/stderr")"
+rm "$tmp/gh/blob/$base_sha.json" "$tmp/gh/blob/$fork_sha.json"
+reuse "$r" 12:601
+touch "$tmp/gh/blob/$fork_sha.error"
+! DEFAULT_BRANCH=master collect 1 "$(matrix)" "[\"$r\"]" && grep -q "cannot read build-pr.yml at $fork_sha" "$tmp/stderr" &&
+  pass "an error reading a fork's build-pr.yml fails, it does not read as unchanged" || fail "blob error: $(cat "$tmp/stderr")"
diff --git a/tests/check-dkms.sh b/tests/check-dkms.sh
new file mode 100755
index 0000000000..112da13fc7
--- /dev/null
+++ b/tests/check-dkms.sh
@@ -0,0 +1,538 @@
+#!/bin/bash
+# Self-test for bin/check-dkms's plan: which packages of a channel are kernels
+# and DKMS modules, which kernel/module pairs a check builds (only those that
+# touch a changed package), and that every published DKMS package is in the
+# registry. The build itself needs root and real packages; the DKMS check
+# workflow runs it.
+set -euo pipefail
+ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
+pass() { echo "PASS: $1"; }
+fail() { echo "FAIL: $1"; exit 1; }
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+entry() { # entry <db> <name> <version> <file>...: one package in a fixture database
+  local dir="$tmp/$1/$2-$3" path
+  mkdir -p "$dir"
+  printf '%%FILENAME%%\n%s-%s-x86_64.pkg.tar.zst\n\n%%NAME%%\n%s\n\n%%VERSION%%\n%s\n\n%%SHA256SUM%%\n%s\n' \
+    "$2" "$3" "$2" "$3" "$(printf '%s' "$2$3" | sha256sum | cut -d' ' -f1)" >"$dir/desc"
+  {
+    echo '%FILES%'
+    for path in "${@:4}"; do echo "$path"; done
+  } >"$dir/files"
+}
+channel() { # channel <db>: pack a fixture database
+  bsdtar -czf "$tmp/$1.files" -C "$tmp/$1" .
+}
+for db in edge rc; do
+  entry $db linux-omarchy-bore-headers 7.2.8-9 usr/share/doc/linux-omarchy-bore-headers/README
+  entry $db intel-ipu7-camera 1.0.6-3 usr/src/ipu7-drivers-1.0.6/dkms.conf usr/src/vision-drivers-1.0.6/dkms.conf usr/bin/ipu7-tool
+  entry $db hyprland 0.56.2-4 usr/bin/Hyprland
+done
+entry rc linux-omarchy-headers 7.2.8-8 usr/lib/modules/7.2.8-8-omarchy/build/Makefile
+entry rc tuxedo-drivers-nocompatcheck-dkms 4.22.1-2 usr/src/tuxedo-drivers-v4.22.1/dkms.conf
+entry edge linux-omarchy-headers 7.2.8-9 usr/lib/modules/7.2.8-9-omarchy/build/Makefile usr/lib/modules/7.2.8-9-omarchy/build/include/acpi/battery.h
+entry edge tuxedo-drivers-nocompatcheck-dkms 4.22.1-2 usr/src/tuxedo-drivers-v4.22.1/dkms.conf usr/src/tuxedo-drivers-v4.22.1/Kbuild
+channel edge
+channel rc
+
+printf '%s\n' '# test registry' 'tuxedo-drivers-nocompatcheck-dkms x86_64' 'intel-ipu7-camera x86_64' 'xpadneo-dkms x86_64 aarch64' >"$tmp/registry"
+export OMARCHY_DKMS_REGISTRY="$tmp/registry"
+check() { "$ROOT/bin/check-dkms" plan --arch x86_64 --files-db "$tmp/edge.files" "$@" 2>"$tmp/stderr"; }
+# promote <target> <source> [options]: the plan for a promotion into target.
+promote() { "$ROOT/bin/check-dkms" plan --arch x86_64 --files-db "$tmp/$1.files" --from-db "$tmp/$2.files" "${@:3}" 2>"$tmp/stderr"; }
+
+plan=$(check) || fail "a database whose DKMS packages are all listed plans cleanly: $(cat "$tmp/stderr")"
+grep -qP '^kernel\tlinux-omarchy-headers\t7.2.8-9\t7.2.8-9-omarchy$' <<<"$plan" &&
+  pass "a headers package with a build tree is a kernel, named by its module directory" || fail "kernel: $plan"
+! grep -q bore <<<"$plan" && pass "a transitional headers package without a build tree is not a kernel" || fail "bore: $plan"
+grep -qP '^dkms\tintel-ipu7-camera\t1.0.6-3\tipu7-drivers-1.0.6,vision-drivers-1.0.6$' <<<"$plan" &&
+  pass "a package with dkms.conf trees under /usr/src is a DKMS package" || fail "dkms: $plan"
+! grep -q hyprland <<<"$plan" && pass "other packages are left out" || fail "hyprland: $plan"
+[[ $(grep -c '^pair' <<<"$plan") == 3 ]] && grep -qP '^pair\tlinux-omarchy-headers 7.2.8-9-omarchy\tintel-ipu7-camera vision-drivers-1.0.6$' <<<"$plan" &&
+  pass "with nothing to compare against, every kernel/module pair is checked" || fail "all pairs: $plan"
+grep -q 'xpadneo-dkms is listed for x86_64 but not published here' "$tmp/stderr" &&
+  pass "a listed package the channel does not publish is only noted" || fail "note: $(cat "$tmp/stderr")"
+
+# A promotion checks the pairs that touch a version the target lacks, on the
+# target as the promotion leaves it.
+plan=$(promote rc edge)
+[[ $(grep -c '^pair' <<<"$plan") == 3 ]] && grep -q 'linux-omarchy-headers 7.2.8-9-omarchy' <<<"$plan" &&
+  ! grep -q '7.2.8-8-omarchy' <<<"$plan" &&
+  pass "a new kernel is checked against every module, in place of the target's" || fail "new kernel: $plan"
+plan=$(promote edge edge)
+grep -qx 'nothing to check' <<<"$plan" && ! grep -q '^pair' <<<"$plan" &&
+  pass "a promotion that moves no kernel or module checks nothing" || fail "unchanged: $plan"
+
+# A kernel promoted on its own meets the modules the target keeps, not the
+# source's newer ones: stable's machines keep their xpadneo when only
+# linux-omarchy moves from rc.
+entry target linux-omarchy-headers 7.2.8-13 usr/lib/modules/7.2.8-13-omarchy/build/Makefile
+entry target xpadneo-dkms 0.10.4-1 usr/src/hid-xpadneo-v0.10.4/dkms.conf
+entry source linux-omarchy-headers 7.3-3 usr/lib/modules/7.3.0-3-omarchy/build/Makefile
+entry source xpadneo-dkms 0.10.5-1 usr/src/hid-xpadneo-v0.10.5/dkms.conf
+channel target
+channel source
+printf '%s\n' 'xpadneo-dkms x86_64' >"$tmp/registry"
+plan=$(promote target source --packages linux-omarchy-headers) || fail "a narrowed promotion plans: $(cat "$tmp/stderr")"
+[[ $(grep -c '^pair' <<<"$plan") == 1 ]] &&
+  grep -qP '^pair\tlinux-omarchy-headers 7.3.0-3-omarchy\txpadneo-dkms hid-xpadneo-v0.10.4$' <<<"$plan" &&
+  pass "a kernel promoted alone is built against the target's module" || fail "kernel alone: $plan"
+plan=$(promote target source --packages xpadneo-dkms)
+[[ $(grep -c '^pair' <<<"$plan") == 1 ]] &&
+  grep -qP '^pair\tlinux-omarchy-headers 7.2.8-13-omarchy\txpadneo-dkms hid-xpadneo-v0.10.5$' <<<"$plan" &&
+  pass "a module promoted alone is built against the target's kernel" || fail "module alone: $plan"
+plan=$(promote target source)
+[[ $(grep -c '^pair' <<<"$plan") == 1 ]] &&
+  grep -qP '^pair\tlinux-omarchy-headers 7.3.0-3-omarchy\txpadneo-dkms hid-xpadneo-v0.10.5$' <<<"$plan" &&
+  pass "a kernel and a module promoted together are built against each other" || fail "both: $plan"
+legs=$("$ROOT/bin/check-dkms" matrix --arch x86_64 --files-db "$tmp/target.files" --from-db "$tmp/source.files" \
+  --packages linux-omarchy-headers 2>/dev/null)
+[[ $legs == '[{"arch":"x86_64","kernel":"linux-omarchy-headers 7.3-3","module":"xpadneo-dkms 0.10.4-1"}]' ]] &&
+  pass "a promotion's legs name the moving kernel and the target's module" || fail "promotion legs: $legs"
+mkdir -p "$tmp/nofiles/linux-omarchy-headers-7.3-3"
+printf '%%NAME%%\nlinux-omarchy-headers\n\n%%VERSION%%\n7.3-3\n' >"$tmp/nofiles/linux-omarchy-headers-7.3-3/desc"
+channel nofiles
+if promote target nofiles >/dev/null; then
+  fail "a source database that cannot be read must fail the promotion's plan"
+fi
+grep -q 'nofiles.files is not a files database' "$tmp/stderr" &&
+  pass "a source database that cannot be read fails the plan, never checks nothing" || fail "unreadable source: $(cat "$tmp/stderr")"
+mkdir -p "$tmp/empty-local"
+if "$ROOT/bin/check-dkms" plan --arch x86_64 --files-db "$tmp/target.files" --from-db "$tmp/source.files" \
+  --local "$tmp/empty-local" >/dev/null 2>"$tmp/stderr"; then
+  fail "--local and --from together must be refused"
+fi
+grep -q -- '--local and --from are two different checks' "$tmp/stderr" &&
+  pass "--local and --from together are refused" || fail "local and from: $(cat "$tmp/stderr")"
+printf '%s\n' '# test registry' 'tuxedo-drivers-nocompatcheck-dkms x86_64' 'intel-ipu7-camera x86_64' 'xpadneo-dkms x86_64 aarch64' >"$tmp/registry"
+
+printf '%s\n' 'intel-ipu7-camera x86_64' >"$tmp/registry"
+if check >/dev/null; then
+  fail "an unlisted DKMS package must fail the plan"
+fi
+grep -q 'tuxedo-drivers-nocompatcheck-dkms ships a DKMS module for x86_64 but is not in ci/dkms-packages' "$tmp/stderr" &&
+  pass "a published DKMS package missing from the registry fails the plan" || fail "unlisted: $(cat "$tmp/stderr")"
+printf '%s\n' 'tuxedo-drivers-nocompatcheck-dkms x86_64' 'intel-ipu7-camera x86_64' >"$tmp/registry"
+
+# A pull request's fresh package replaces the published one and is what the
+# check is about.
+package() { # package <dir> <name> <version> <arch> <path>...
+  local root="$tmp/pkgroot-$2"
+  rm -rf "$root"
+  mkdir -p "$root"
+  printf 'pkgname = %s\npkgver = %s\narch = %s\n' "$2" "$3" "$4" >"$root/.PKGINFO"
+  [[ -z ${PKGBASE:-} ]] || echo "pkgbase = $PKGBASE" >>"$root/.PKGINFO"
+  for path in "${@:5}"; do mkdir -p "$root/${path%/*}"; touch "$root/$path"; done
+  mkdir -p "$1"
+  bsdtar -cf "$1/$2-$3-$4.pkg.tar.zst" --zstd -C "$root" .PKGINFO usr
+}
+package "$tmp/local" tuxedo-drivers-nocompatcheck-dkms 4.22.1-3 x86_64 usr/src/tuxedo-drivers-v4.22.1/dkms.conf
+package "$tmp/local" yt6801-dkms 1.0.34-2 aarch64 usr/src/yt6801-1.0.34/dkms.conf
+plan=$(check --local "$tmp/local") || fail "a local DKMS package plans: $(cat "$tmp/stderr")"
+grep -qP '^dkms\ttuxedo-drivers-nocompatcheck-dkms\t4.22.1-3\t' <<<"$plan" && [[ $(grep -c $'^dkms\ttuxedo' <<<"$plan") == 1 ]] &&
+  pass "a local package replaces the published one of the same name" || fail "replace: $plan"
+[[ $(grep -c '^pair' <<<"$plan") == 1 ]] && grep -qP '^pair\tlinux-omarchy-headers 7.2.8-9-omarchy\ttuxedo-drivers-nocompatcheck-dkms tuxedo-drivers-v4.22.1$' <<<"$plan" &&
+  pass "a local DKMS package is checked against every kernel, and only it" || fail "local pairs: $plan"
+! grep -q yt6801 <<<"$plan" && pass "a local package for another architecture is ignored" || fail "arch: $plan"
+
+package "$tmp/local-kernel" linux-omarchy-headers 7.2.9-1 x86_64 usr/lib/modules/7.2.9-1-omarchy/build/Makefile
+plan=$(check --local "$tmp/local-kernel")
+[[ $(grep -c '^pair' <<<"$plan") == 3 ]] && grep -q 'linux-omarchy-headers 7.2.9-1-omarchy' <<<"$plan" &&
+  pass "a local kernel is checked against every module" || fail "local kernel: $plan"
+
+package "$tmp/local-lost" linux-omarchy-headers 7.2.9-1 x86_64 usr/share/doc/linux-omarchy-headers/README
+if check --local "$tmp/local-lost" >/dev/null; then
+  fail "a local kernel that lost its build tree must not let the published one stand in"
+fi
+grep -q "the local linux-omarchy-headers is a 'other' package, but the published one is 'kernel'" "$tmp/stderr" &&
+  pass "a local package that lost its tree is an error, not the published one" || fail "lost: $(cat "$tmp/stderr")"
+
+mkdir -p "$tmp/empty"
+if check --local "$tmp/empty" >/dev/null; then fail "an empty --local must fail"; fi
+grep -q 'holds no package for x86_64' "$tmp/stderr" && pass "an empty --local is an error" || fail "empty: $(cat "$tmp/stderr")"
+if check --local "$tmp/missing" >/dev/null; then fail "a missing --local must fail"; fi
+grep -q 'is not a directory' "$tmp/stderr" && pass "a missing --local is an error" || fail "missing: $(cat "$tmp/stderr")"
+# A pull request's package names reach logs and markdown: makepkg's rules only.
+package "$tmp/local-evil" 'xpadneo##[add-mask]x' 1-1 x86_64 usr/src/hid-xpadneo-1/dkms.conf
+mv "$tmp/local-evil"/*.pkg.tar.zst "$tmp/local-evil/evil-1-1-x86_64.pkg.tar.zst"
+if check --local "$tmp/local-evil" >/dev/null; then fail "a package name makepkg would not allow must fail"; fi
+grep -q 'has a package name makepkg would not allow' "$tmp/stderr" || fail "evil name: $(cat "$tmp/stderr")"
+package "$tmp/local-evil2" xpadneo-dkms '1-1 ##[x]' x86_64 usr/src/hid-xpadneo-1/dkms.conf
+mv "$tmp/local-evil2"/*.pkg.tar.zst "$tmp/local-evil2/evil-1-1-x86_64.pkg.tar.zst"
+if check --local "$tmp/local-evil2" >/dev/null; then fail "a version makepkg would not allow must fail"; fi
+grep -q 'has a version makepkg would not allow' "$tmp/stderr" || fail "evil version: $(cat "$tmp/stderr")"
+package "$tmp/local-evil3" xpadneo-dkms 1-1 x86_64 'usr/src/hid xpadneo [x]/dkms.conf'
+if check --local "$tmp/local-evil3" >/dev/null; then fail "a DKMS tree name makepkg would not allow must fail"; fi
+grep -q 'ships a kernel or DKMS tree with a name makepkg would not allow' "$tmp/stderr" ||
+  fail "evil tree: $(cat "$tmp/stderr")"
+mkdir -p "$tmp/local-evil4"
+cp "$tmp/local/tuxedo-drivers-nocompatcheck-dkms-4.22.1-3-x86_64.pkg.tar.zst" "$tmp/local-evil4/tuxedo"$'\t'"x##[add-mask]y-1-1-x86_64.pkg.tar.zst"
+if check --local "$tmp/local-evil4" >/dev/null; then fail "a package file name with a tab must fail"; fi
+grep -q 'holds a package file whose name makepkg would not produce' "$tmp/stderr" && ! grep -qF '##[' "$tmp/stderr" &&
+  pass "a pull request's package name, version, tree or file name outside makepkg's rules is an error, and not repeated" || fail "evil file: $(cat "$tmp/stderr")"
+
+# kernels= limits a module to the kernels it is installed with.
+entry scoped linux-aurora-headers 7.1.12-2 usr/lib/modules/7.1.12-2-ARCH/build/Makefile
+entry scoped linux-omarchy-headers 7.2.8-13 usr/lib/modules/7.2.8-13-omarchy/build/Makefile
+entry scoped omarchy-ane-dkms 0.4.9-1 usr/src/omarchy-ane-0.4.9/dkms.conf
+entry scoped xpadneo-dkms 0.10.4-1 usr/src/hid-xpadneo-v0.10.4/dkms.conf
+channel scoped
+printf '%s\n' 'omarchy-ane-dkms aarch64 kernels=linux-aurora-headers' 'xpadneo-dkms x86_64 aarch64' >"$tmp/registry"
+# These three take every kernel: they are about kernels=, not about which
+# kernels the check is for.
+plan=$(OMARCHY_DKMS_KERNELS='*' "$ROOT/bin/check-dkms" plan --arch aarch64 --files-db "$tmp/scoped.files" 2>/dev/null)
+grep -qP '^pair\tlinux-aurora-headers 7.1.12-2-ARCH\tomarchy-ane-dkms ' <<<"$plan" &&
+  ! grep -qP '^pair\tlinux-omarchy-headers \S+\tomarchy-ane-dkms ' <<<"$plan" &&
+  [[ $(grep -c $'^pair\t.*xpadneo-dkms' <<<"$plan") == 2 ]] &&
+  pass "a module limited to some kernels is only built against those" || fail "scope: $plan"
+
+# kernels=!<headers> builds a module against every kernel but those.
+entry scoped linux-aarch64-headers 7.0.14-1 usr/lib/modules/7.0.14-1-ARCH/build/Makefile
+entry scoped nvidia-open-dkms 615.78.08-3 usr/src/nvidia-615.78.08/dkms.conf
+entry scoped v4l2loopback-dkms 0.15.4-2 usr/src/v4l2loopback-0.15.4/dkms.conf
+channel scoped
+nvidia_kernels() { awk -F'\t' '$1 == "pair" && $3 ~ /^nvidia-open-dkms / { split($2, k, " "); print k[1] }' | sort | tr '\n' ' '; }
+printf '%s\n' 'omarchy-ane-dkms aarch64 kernels=linux-aurora-headers' 'xpadneo-dkms x86_64 aarch64' \
+  'nvidia-open-dkms aarch64 kernels=!linux-aurora-headers' 'v4l2loopback-dkms aarch64' >"$tmp/registry"
+plan=$(OMARCHY_DKMS_KERNELS='*' "$ROOT/bin/check-dkms" plan --arch aarch64 --files-db "$tmp/scoped.files" 2>"$tmp/stderr") || fail "exclude plan: $(cat "$tmp/stderr")"
+nvidia=$(nvidia_kernels <<<"$plan")
+[[ $nvidia == "linux-aarch64-headers linux-omarchy-headers " ]] && [[ $(grep -c $'^pair\t.*xpadneo-dkms' <<<"$plan") == 3 ]] &&
+  pass "a module that excludes a kernel builds against every other one" || fail "exclude: $nvidia / $plan"
+# The registry itself: no Mac has an NVIDIA GPU. Its repo= packages come from
+# a fixture extra repository.
+mkdir -p "$tmp/extra-arm/v4l2loopback-dkms-0.15.4-2"
+cp "$tmp/scoped/v4l2loopback-dkms-0.15.4-2"/* "$tmp/extra-arm/v4l2loopback-dkms-0.15.4-2/"
+bsdtar -czf "$tmp/extra-arm.files" -C "$tmp/extra-arm" .
+plan=$(OMARCHY_DKMS_KERNELS='*' OMARCHY_DKMS_REGISTRY="$ROOT/ci/dkms-packages" "$ROOT/bin/check-dkms" plan --arch aarch64 --files-db "$tmp/scoped.files" \
+  --repo-files-db "extra=$tmp/extra-arm.files" 2>"$tmp/stderr") || fail "registry plan: $(cat "$tmp/stderr")"
+nvidia=$(nvidia_kernels <<<"$plan")
+[[ $nvidia == "linux-aarch64-headers linux-omarchy-headers " ]] &&
+  pass "ci/dkms-packages builds aarch64 nvidia-open-dkms against every kernel but linux-aurora" || fail "registry nvidia: $nvidia"
+
+# By default the check builds against Omarchy's own kernels only, and names
+# the others it leaves out.
+plan=$("$ROOT/bin/check-dkms" plan --arch aarch64 --files-db "$tmp/scoped.files" 2>"$tmp/stderr") || fail "default kernels: $(cat "$tmp/stderr")"
+! grep -qE '^(kernel|pair)'$'\t''linux-(aurora|aarch64)-headers' <<<"$plan" &&
+  [[ $(nvidia_kernels <<<"$plan") == "linux-omarchy-headers " ]] &&
+  ! grep -q 'omarchy-ane-dkms ' <<<"$(grep '^pair' <<<"$plan")" &&
+  grep -q 'linux-aurora-headers (linux-aurora-headers) is not a kernel this check builds against (linux-omarchy\*); left out' "$tmp/stderr" &&
+  grep -q 'linux-aarch64-headers (linux-aarch64-headers) is not a kernel this check builds against' "$tmp/stderr" &&
+  pass "only linux-omarchy* kernels are built against, and the others are named" || fail "default kernels: $plan $(cat "$tmp/stderr")"
+printf '%s\n' 'tuxedo-drivers-nocompatcheck-dkms x86_64' 'intel-ipu7-camera x86_64' >"$tmp/registry"
+
+# repo= packages come from an Arch repository's files database. They pair
+# whenever a kernel changes and never count as a change of their own.
+entry extra v4l2loopback-dkms 0.15.4-2 usr/src/v4l2loopback-0.15.4/dkms.conf
+entry extra hyprland-git 1-1 usr/bin/Hyprland
+channel extra
+printf '%s\n' 'tuxedo-drivers-nocompatcheck-dkms x86_64' 'intel-ipu7-camera x86_64' 'v4l2loopback-dkms x86_64 repo=extra' >"$tmp/registry"
+repo=(--repo-files-db "extra=$tmp/extra.files")
+plan=$(check "${repo[@]}") || fail "a repo= package plans: $(cat "$tmp/stderr")"
+grep -qP '^dkms\tv4l2loopback-dkms\t0.15.4-2\tv4l2loopback-0.15.4$' <<<"$plan" && ! grep -q hyprland-git <<<"$plan" &&
+  grep -qP '^pair\tlinux-omarchy-headers 7.2.8-9-omarchy\tv4l2loopback-dkms v4l2loopback-0.15.4$' <<<"$plan" &&
+  pass "a repo= package is read from its repository and checked against every kernel" || fail "repo: $plan"
+! grep -q 'v4l2loopback-dkms is listed for x86_64 but not published here' "$tmp/stderr" &&
+  pass "a repo= package is not reported as missing from this repository" || fail "repo note: $(cat "$tmp/stderr")"
+plan=$(promote edge edge "${repo[@]}")
+grep -qx 'nothing to check' <<<"$plan" &&
+  pass "a promotion that moves no kernel does not check repo= packages" || fail "repo unchanged: $plan"
+plan=$(promote rc edge "${repo[@]}")
+grep -qP '^pair\tlinux-omarchy-headers 7.2.8-9-omarchy\tv4l2loopback-dkms ' <<<"$plan" &&
+  pass "a promotion that moves a kernel checks it against repo= packages" || fail "repo kernel: $plan"
+plan=$(check "${repo[@]}" --local "$tmp/local-kernel")
+grep -qP '^pair\tlinux-omarchy-headers 7.2.9-1-omarchy\tv4l2loopback-dkms ' <<<"$plan" &&
+  pass "a pull request's kernel is checked against repo= packages" || fail "repo local kernel: $plan"
+plan=$(check --local "$tmp/local") || fail "a pull request without a kernel must not need repository databases: $(cat "$tmp/stderr")"
+! grep -q v4l2loopback <<<"$plan" &&
+  pass "a pull request without a kernel neither downloads nor checks repo= packages" || fail "repo not needed: $plan"
+plan=$(check "${repo[@]}" --from-repos)
+[[ $(grep -c '^pair' <<<"$plan") == 1 ]] && grep -q 'v4l2loopback-dkms' <<<"$plan" &&
+  pass "--from-repos checks only repo= packages, against every kernel" || fail "from-repos: $plan"
+if check >/dev/null; then fail "a whole-channel plan without the repository's files database must fail"; fi
+grep -q "no files database given for v4l2loopback-dkms's repository, extra" "$tmp/stderr" &&
+  pass "a missing repository database is an error" || fail "no repo db: $(cat "$tmp/stderr")"
+printf '%s\n' 'tuxedo-drivers-nocompatcheck-dkms x86_64' 'intel-ipu7-camera x86_64' 'nosuch-dkms x86_64 repo=extra' >"$tmp/registry"
+if check "${repo[@]}" >/dev/null; then fail "a repo= package its repository lacks must fail"; fi
+grep -q 'nosuch-dkms is listed as coming from extra, but extra has no DKMS package of that name' "$tmp/stderr" &&
+  pass "a repo= package missing from its repository is an error" || fail "repo missing: $(cat "$tmp/stderr")"
+printf '%s\n' 'tuxedo-drivers-nocompatcheck-dkms x86_64' 'intel-ipu7-camera x86_64' 'v4l2loopback-dkms x86_64 repo=extra' >"$tmp/registry"
+package "$tmp/local-own" v4l2loopback-dkms 0.15.5-1 x86_64 usr/src/v4l2loopback-0.15.5/dkms.conf
+package "$tmp/local-own" linux-omarchy-headers 7.2.9-1 x86_64 usr/lib/modules/7.2.9-1-omarchy/build/Makefile
+plan=$(check "${repo[@]}" --local "$tmp/local-own")
+grep -qP '^dkms\tv4l2loopback-dkms\t0.15.5-1\t' <<<"$plan" && [[ $(grep -c $'^dkms\tv4l2loopback-dkms' <<<"$plan") == 1 ]] &&
+  grep -q 'v4l2loopback-dkms is built here too' "$tmp/stderr" &&
+  pass "this repository's own copy of a repo= package is the one checked" || fail "own copy: $plan $(cat "$tmp/stderr")"
+plan=$(promote edge edge "${repo[@]}" --from-repos)
+[[ $(grep -c '^pair' <<<"$plan") == 1 ]] && grep -qP '^pair\tlinux-omarchy-headers 7.2.8-9-omarchy\tv4l2loopback-dkms ' <<<"$plan" &&
+  pass "--from-repos checks repo= packages even in a promotion that moves nothing" || fail "from-repos from: $plan"
+
+# This repository's own copy of a repo= name moves with promotions like any
+# other package.
+for db in own-old own-new; do
+  entry $db linux-omarchy-headers 7.2.8-9 usr/lib/modules/7.2.8-9-omarchy/build/Makefile
+done
+entry own-old v4l2loopback-dkms 0.15.4-1 usr/src/v4l2loopback-0.15.4/dkms.conf
+entry own-new v4l2loopback-dkms 0.15.5-1 usr/src/v4l2loopback-0.15.5/dkms.conf
+channel own-old
+channel own-new
+plan=$(promote own-old own-new "${repo[@]}")
+grep -qP '^pair\tlinux-omarchy-headers 7.2.8-9-omarchy\tv4l2loopback-dkms v4l2loopback-0.15.5$' <<<"$plan" &&
+  pass "a promotion that moves this repository's copy of a repo= name checks it" || fail "own copy promoted: $plan"
+printf '%s\n' 'tuxedo-drivers-nocompatcheck-dkms x86_64' 'intel-ipu7-camera x86_64' >"$tmp/registry"
+
+# A pull request that adds a DKMS recipe is checked before it publishes, even
+# though master's registry does not list it yet.
+package "$tmp/local-new" hid-nintendo2-dkms 0.1.0-1 x86_64 usr/src/hid-nintendo2-0.1.0/dkms.conf
+plan=$(check --local "$tmp/local-new") || fail "an unlisted fresh DKMS package plans: $(cat "$tmp/stderr")"
+[[ $(grep -c '^pair' <<<"$plan") == 1 ]] && grep -qP '^pair\tlinux-omarchy-headers 7.2.8-9-omarchy\thid-nintendo2-dkms hid-nintendo2-0.1.0$' <<<"$plan" &&
+  grep -q 'hid-nintendo2-dkms is not in ci/dkms-packages yet' "$tmp/stderr" &&
+  pass "an unlisted fresh DKMS package is checked against every kernel" || fail "new recipe: $plan $(cat "$tmp/stderr")"
+
+# matrix: the legs a CI run fans out into, one per kernel and DKMS package,
+# decided on the host before any container.
+matrix() { "$ROOT/bin/check-dkms" matrix --arch "${ARCH:-x86_64}" --files-db "$tmp/edge.files" "$@" 2>"$tmp/stderr"; }
+legs=$(matrix) || fail "a channel's matrix: $(cat "$tmp/stderr")"
+jq -e 'length == 2 and (map(.module) | sort) == ["intel-ipu7-camera 1.0.6-3", "tuxedo-drivers-nocompatcheck-dkms 4.22.1-2"]
+  and all(.arch == "x86_64" and .kernel == "linux-omarchy-headers 7.2.8-9")' <<<"$legs" >/dev/null &&
+  pass "a channel's matrix has one leg per kernel and DKMS package, named with versions, however many trees it ships" || fail "legs: $legs"
+package "$tmp/local-plain" hyprland 0.56.2-5 x86_64 usr/bin/Hyprland
+[[ $(matrix --local "$tmp/local-plain") == '[]' ]] &&
+  pass "a build without kernels or DKMS packages has no legs" || fail "plain: $(cat "$tmp/stderr")"
+legs=$(matrix --local "$tmp/local")
+jq -e '. == [{"arch": "x86_64", "kernel": "linux-omarchy-headers 7.2.8-9", "module": "tuxedo-drivers-nocompatcheck-dkms 4.22.1-3"}]' <<<"$legs" >/dev/null &&
+  pass "a build with a DKMS package has a leg per kernel for it" || fail "dkms legs: $legs"
+legs=$(matrix --local "$tmp/local-kernel")
+jq -e 'length == 2 and all(.kernel == "linux-omarchy-headers 7.2.9-1")' <<<"$legs" >/dev/null &&
+  pass "a build with a kernel has a leg per module for it" || fail "kernel legs: $legs"
+# A package the matrix cannot read is an error, never an empty matrix.
+mkdir -p "$tmp/local-unreadable"
+echo "not an archive" >"$tmp/local-unreadable/xpadneo-dkms-1-1-x86_64.pkg.tar.zst"
+if out=$(matrix --local "$tmp/local-unreadable"); then fail "an unreadable package must fail the matrix, not give: $out"; fi
+grep -q 'cannot read' "$tmp/stderr" || fail "unreadable: $(cat "$tmp/stderr")"
+if out=$(matrix --local "$tmp/local-evil"); then fail "a package with a bad name must fail the matrix, not give: $out"; fi
+grep -q 'has a package name makepkg would not allow' "$tmp/stderr" &&
+  pass "a package the matrix cannot read or trust fails it, it is not an empty matrix" || fail "evil matrix: $(cat "$tmp/stderr")"
+[[ $(ARCH=aarch64 matrix --local "$tmp/local-kernel") == '[]' ]] &&
+  pass "an architecture the build has nothing for has no legs, not an error" || fail "other arch: $(cat "$tmp/stderr")"
+if matrix --local "$tmp/local-lost" >/dev/null; then fail "a kernel that lost its tree must fail the matrix"; fi
+grep -q "the local linux-omarchy-headers is a 'other' package, but the published one is 'kernel'" "$tmp/stderr" &&
+  pass "a package that lost its role fails the matrix, before any container" || fail "lost: $(cat "$tmp/stderr")"
+
+# --save-local keeps what the legs install: kernels and DKMS packages.
+package "$tmp/local-mixed" hyprland 0.56.2-5 x86_64 usr/bin/Hyprland
+package "$tmp/local-mixed" linux-omarchy-headers 7.2.9-1 x86_64 usr/lib/modules/7.2.9-1-omarchy/build/Makefile
+package "$tmp/local-mixed" yt6801-dkms 1.0.34-2 aarch64 usr/src/yt6801-1.0.34/dkms.conf
+# The fixture channel stands in for both architectures here.
+printf '%s\n' 'tuxedo-drivers-nocompatcheck-dkms x86_64 aarch64' 'intel-ipu7-camera x86_64 aarch64' 'yt6801-dkms aarch64' >"$tmp/registry-both"
+matrix --local "$tmp/local-mixed" --save-local "$tmp/saved" >/dev/null &&
+  OMARCHY_DKMS_REGISTRY="$tmp/registry-both" ARCH=aarch64 matrix --local "$tmp/local-mixed" --save-local "$tmp/saved" >/dev/null ||
+  fail "save-local: $(cat "$tmp/stderr")"
+[[ $(ls "$tmp/saved" | tr '\n' ' ') == "linux-omarchy-headers-7.2.9-1-x86_64.pkg.tar.zst yt6801-dkms-1.0.34-2-aarch64.pkg.tar.zst " ]] &&
+  pass "--save-local keeps each architecture's kernels and DKMS packages, nothing else" || fail "saved: $(ls "$tmp/saved")"
+
+# --all: every pair of the channel, with a build's packages in place of the
+# published ones; a build that ships nothing relevant still checks them all.
+plan=$(check --local "$tmp/local" --all) || fail "all: $(cat "$tmp/stderr")"
+[[ $(grep -c '^pair' <<<"$plan") == 3 ]] && grep -qP '^dkms\ttuxedo-drivers-nocompatcheck-dkms\t4.22.1-3\t' <<<"$plan" &&
+  pass "--all checks every pair, the build's package in place of the published one" || fail "all: $plan"
+legs=$(matrix --local "$tmp/local-plain" --all)
+jq -e 'length == 2' <<<"$legs" >/dev/null &&
+  pass "--all gives every leg even for a build without kernels or DKMS packages" || fail "all plain: $legs $(cat "$tmp/stderr")"
+
+# One leg: --kernel (headers name or pkgbase) and --module keep its pairs only.
+plan=$(check --kernel linux-omarchy-headers --module intel-ipu7-camera) || fail "leg: $(cat "$tmp/stderr")"
+[[ $(grep -c '^pair' <<<"$plan") == 2 ]] && ! grep -q $'^pair\t.*tuxedo' <<<"$plan" &&
+  pass "a leg keeps every tree of its module against its kernel, and nothing else" || fail "leg: $plan"
+PKGBASE=linux-omarchy package "$tmp/local-base" linux-omarchy-headers 7.2.9-1 x86_64 usr/lib/modules/7.2.9-1-omarchy/build/Makefile
+legs=$(matrix --local "$tmp/local-base")
+jq -e 'all(.kernel == "linux-omarchy 7.2.9-1")' <<<"$legs" >/dev/null &&
+  plan=$(check --local "$tmp/local-base" --kernel "linux-omarchy 7.2.9-1" --module "tuxedo-drivers-nocompatcheck-dkms 4.22.1-2") &&
+  [[ $(grep -c '^pair' <<<"$plan") == 1 ]] &&
+  pass "legs name a kernel by its pkgbase, and --kernel finds it by that" || fail "pkgbase: $legs $plan $(cat "$tmp/stderr")"
+if check --kernel linux-gone >/dev/null; then fail "a leg the plan no longer has must fail"; fi
+grep -q 'this plan has no pair for kernel linux-gone' "$tmp/stderr" &&
+  pass "a leg whose pair left the plan fails, so the run is redone" || fail "gone: $(cat "$tmp/stderr")"
+if check --kernel "linux-omarchy-headers 7.2.8-8" >/dev/null; then fail "a leg for a version the channel moved past must fail"; fi
+grep -q 'this plan has no pair for kernel linux-omarchy-headers 7.2.8-8' "$tmp/stderr" &&
+  pass "a leg for a version the channel no longer has fails, not checks the new one" || fail "moved: $(cat "$tmp/stderr")"
+
+# known-broken="<why>": its failures are expected, and a pair that builds
+# fails the check so the mark comes off. The reason may hold spaces and words
+# like an architecture, which must not be read as fields.
+printf '%s\n' 'macbook12-spi-driver-dkms x86_64 known-broken="no build since Linux 6.10 on x86_64 or aarch64"' \
+  'tuxedo-drivers-nocompatcheck-dkms x86_64' 'intel-ipu7-camera x86_64' >"$tmp/registry"
+judge() { "$ROOT/bin/check-dkms" judge --arch "${ARCH:-x86_64}" 2>"$tmp/stderr"; }
+raw() { printf 'linux-omarchy-headers\t7.2.8-9-omarchy\t%s\t%s\t%s\t-\n' "$@"; }
+verdicts() { cut -f5 <<<"$1" | tr '\n' ' '; }
+out=$(raw macbook12-spi-driver-dkms macbook12-spi-driver-0+git.315 failed tuxedo-drivers-nocompatcheck-dkms tuxedo-drivers-v4.22.1 built | judge) &&
+  [[ $(verdicts "$out") == "known-broken built " ]] && grep -qF 'known broken: no build since Linux 6.10 on x86_64 or aarch64' <<<"$out" &&
+  pass "a known-broken package that fails is reported as known broken, and passes" || fail "known broken: $out $(cat "$tmp/stderr")"
+if out=$(raw macbook12-spi-driver-dkms macbook12-spi-driver-0+git.315 built | judge); then
+  fail "a known-broken package that builds must fail the check: $out"
+fi
+[[ $(verdicts "$out") == "fixed " ]] && grep -qF 'builds now; remove its known-broken mark' <<<"$out" &&
+  pass "a known-broken package that builds fails, so the mark is removed" || fail "fixed: $out"
+out=$(raw macbook12-spi-driver-dkms macbook12-spi-driver-0+git.315 excluded | judge) && [[ $(verdicts "$out") == "excluded " ]] &&
+  pass "a known-broken package that a kernel excludes is neither broken nor fixed" || fail "excluded: $out"
+if out=$(raw tuxedo-drivers-nocompatcheck-dkms tuxedo-drivers-v4.22.1 failed | judge); then fail "an unmarked failure must fail: $out"; fi
+[[ $(verdicts "$out") == "failed " ]] && pass "a package without the mark that fails, fails" || fail "failed: $out"
+plan=$(ARCH=aarch64 "$ROOT/bin/check-dkms" plan --arch aarch64 --files-db "$tmp/edge.files" 2>&1 || true)
+! grep -q 'macbook12-spi-driver-dkms is listed for aarch64' <<<"$plan" &&
+  pass "an architecture named inside a reason does not list the package for it" || fail "reason fields: $plan"
+printf '%s\n' 'tuxedo-drivers-nocompatcheck-dkms x86_64 known_broken="typo"' >"$tmp/registry"
+if check >/dev/null; then fail "an unknown registry field must fail"; fi
+grep -q 'unknown field known_broken="typo"' "$tmp/stderr" &&
+  pass "a misspelt registry field is an error, not ignored" || fail "unknown field: $(cat "$tmp/stderr")"
+printf '%s\n' 'tuxedo-drivers-nocompatcheck-dkms x86_64 known-broken=""' >"$tmp/registry"
+if check >/dev/null; then fail "a known-broken mark without a reason must fail"; fi
+grep -q 'known-broken needs a reason' "$tmp/stderr" &&
+  pass "a known-broken mark needs a reason" || fail "no reason: $(cat "$tmp/stderr")"
+# The registry itself: macbook12-spi-driver-dkms is marked.
+out=$(raw macbook12-spi-driver-dkms macbook12-spi-driver-0+git.315 failed | OMARCHY_DKMS_REGISTRY="$ROOT/ci/dkms-packages" judge) &&
+  [[ $(verdicts "$out") == "known-broken " ]] &&
+  pass "ci/dkms-packages marks macbook12-spi-driver-dkms known broken" || fail "registry mark: $out $(cat "$tmp/stderr")"
+printf '%s\n' 'tuxedo-drivers-nocompatcheck-dkms x86_64' 'intel-ipu7-camera x86_64' >"$tmp/registry"
+
+# container: the leg's outcome is decided out here, from run's exit status
+# and the verdicts it leaves in /results. docker is a stub that writes
+# $FAKE_PAIRS there, prints a workflow command, and exits $FAKE_STATUS. It
+# writes the environment it was given to $FAKE_ENV.
+mkdir -p "$tmp/dockerbin"
+cat >"$tmp/dockerbin/docker" <<'DOCKER'
+#!/bin/bash
+results=""
+while (($#)); do
+  if [[ $1 == -v && $2 == *:/results ]]; then results=${2%:/results}; fi
+  if [[ $1 == -e ]]; then echo "$2" >>"${FAKE_ENV:-/dev/null}"; fi
+  shift
+done
+[[ -z ${FAKE_PAIRS:-} ]] || cp "$FAKE_PAIRS" "$results/pairs.tsv"
+echo "::error::printed by the pull request's Makefile"
+exit "$FAKE_STATUS"
+DOCKER
+chmod +x "$tmp/dockerbin/docker"
+leg() { # leg <status> <verdict>...: run container with a stub run; sets $out and $leg_status
+  local v
+  : >"$tmp/pairs.tsv"
+  for v in "${@:2}"; do
+    printf 'linux-omarchy-headers\t7.2.8-9-omarchy\tintel-ipu7-camera\t%s-1.0.6\t%s\t%s\n' "${v%%:*}" "${v#*:}" \
+      "$(case ${v#*:} in built) echo built ;; excluded) echo 'excluded (BUILD_EXCLUSIVE)' ;; known-broken) echo 'known broken: why' ;; *) echo FAILED ;; esac)" >>"$tmp/pairs.tsv"
+  done
+  leg_status=0
+  out=$(PATH="$tmp/dockerbin:$PATH" FAKE_STATUS=$1 FAKE_PAIRS=$([[ $# -gt 1 ]] && echo "$tmp/pairs.tsv") GITHUB_ACTIONS=true GITHUB_STEP_SUMMARY="" \
+    "$ROOT/bin/check-dkms" container --arch x86_64 --channel edge --kernel "linux-omarchy 7.2.8-9" --module "intel-ipu7-camera 1.0.6-3" \
+    --result "$tmp/result.json" 2>&1) || leg_status=$?
+}
+outcome() { jq -r .outcome "$tmp/result.json"; }
+leg 0 ipu7:built
+((leg_status == 0)) && [[ $(outcome) == passed ]] && jq -e '.kernel == "linux-omarchy 7.2.8-9" and .module == "intel-ipu7-camera 1.0.6-3" and .detail == ""' "$tmp/result.json" >/dev/null &&
+  pass "a leg whose pairs built passed, named as the matrix names it" || fail "passed: $out $(cat "$tmp/result.json")"
+leg 0 ipu7:built vision:excluded
+((leg_status == 0)) && [[ $(outcome) == passed ]] && jq -e '.detail == "ipu7-1.0.6: built; vision-1.0.6: excluded (BUILD_EXCLUSIVE)"' "$tmp/result.json" >/dev/null &&
+  pass "a leg with several trees passes on its worst one and names each" || fail "trees: $(cat "$tmp/result.json")"
+leg 0 ipu7:known-broken
+((leg_status == 0)) && [[ $(outcome) == known-broken ]] &&
+  pass "a known-broken leg passes, reported as known broken" || fail "known broken: $(cat "$tmp/result.json")"
+leg 1 ipu7:fixed
+((leg_status == 1)) && [[ $(outcome) == fixed ]] &&
+  pass "a known-broken leg that builds fails" || fail "fixed: $(cat "$tmp/result.json")"
+leg 1 ipu7:failed
+((leg_status == 1)) && [[ $(outcome) == failed ]] && pass "a failed leg fails" || fail "failed: $(cat "$tmp/result.json")"
+leg 2
+((leg_status == 1)) && [[ $(outcome) == error ]] && grep -q 'exit status 2' "$tmp/result.json" &&
+  pass "a run that stopped before any verdict is an error, not a pass" || fail "stopped: $(cat "$tmp/result.json")"
+leg 0 ipu7:failed
+((leg_status == 1)) && [[ $(outcome) == error ]] &&
+  pass "an exit status that disagrees with the verdicts is an error" || fail "disagree: $(cat "$tmp/result.json")"
+token=$(sed -n 's/^::stop-commands::\([0-9a-f]\{32\}\)$/\1/p' <<<"$out")
+[[ -n $token ]] && sed -n "/^::stop-commands::$token$/,/^::$token::$/p" <<<"$out" | grep -q '^::error::printed by' &&
+  sed -n "/^::stop-commands::$token$/,/^::$token::$/p" <<<"$out" | grep -q '^==> ' &&
+  pass "nothing the container prints, nor the outcome made from it, acts as a workflow command" || fail "stop-commands: $out"
+printf 'linux-omarchy-headers\t7.2.8-9-omarchy\tintel-ipu7-camera\tipu7-1.0.6\tbuilt\tbuilt\n' >"$tmp/pairs.tsv"
+printf 'linux-omarchy-headers\t7.2.8-9-omarchy\tintel-ipu7-camera\tvision-1.0.6\tgarbage\tbuilt\n' >>"$tmp/pairs.tsv"
+leg_status=0
+PATH="$tmp/dockerbin:$PATH" FAKE_STATUS=0 FAKE_PAIRS="$tmp/pairs.tsv" "$ROOT/bin/check-dkms" container --arch x86_64 --channel edge \
+  --kernel "linux-omarchy 7.2.8-9" --module "intel-ipu7-camera 1.0.6-3" --result "$tmp/result.json" >/dev/null 2>&1 || leg_status=$?
+((leg_status == 1)) && [[ $(outcome) == error ]] && grep -q 'malformed' "$tmp/result.json" &&
+  pass "a verdict row the check does not know is an error, never a pass" || fail "malformed: $(cat "$tmp/result.json")"
+printf 'linux-omarchy-headers\t7.2.8-9-omarchy\tintel-ipu7-camera\tipu7-1.0.6\tbuilt\tbuilt ##[add-mask]x <b>\n' >"$tmp/pairs.tsv"
+PATH="$tmp/dockerbin:$PATH" FAKE_STATUS=0 FAKE_PAIRS="$tmp/pairs.tsv" "$ROOT/bin/check-dkms" container --arch x86_64 --channel edge \
+  --kernel "linux-omarchy 7.2.8-9" --module "intel-ipu7-camera 1.0.6-3" --result "$tmp/result.json" >/dev/null 2>&1 || true
+jq -e '.detail | test("[\\[<>]") | not' "$tmp/result.json" >/dev/null &&
+  pass "the container's text reaches the result as plain text" || fail "plain: $(cat "$tmp/result.json")"
+: >"$tmp/env"
+PATH="$tmp/dockerbin:$PATH" FAKE_STATUS=0 FAKE_PAIRS="$tmp/pairs.tsv" FAKE_ENV="$tmp/env" OMARCHY_DKMS_KERNELS='*' \
+  OMARCHY_PKGS_BASE=https://pkgs.example.invalid "$ROOT/bin/check-dkms" container --arch x86_64 --channel edge \
+  --kernel "linux-omarchy 7.2.8-9" --module "intel-ipu7-camera 1.0.6-3" --result "$tmp/result.json" >/dev/null 2>&1 || true
+grep -qxF 'OMARCHY_DKMS_KERNELS=*' "$tmp/env" && grep -qxF 'OMARCHY_PKGS_BASE=https://pkgs.example.invalid' "$tmp/env" &&
+  pass "the container plans with the kernels and package base set out here" || fail "container env: $(cat "$tmp/env")"
+
+# report: one verdict for a run, from its legs and their results.
+mkdir -p "$tmp/report"
+printf '%s\n' '[{"arch":"x86_64","kernel":"linux-omarchy 7.2.8-9","module":"tuxedo-drivers-nocompatcheck-dkms 4.22.1-3"},' \
+  '{"arch":"x86_64","kernel":"linux-omarchy 7.2.8-9","module":"macbook12-spi-driver-dkms 0+git.315-2"},' \
+  '{"arch":"aarch64","kernel":"linux-aurora 7.1.12.aurora7-2","module":"xpadneo-dkms 0.10.4-1.1"}]' >"$tmp/legs.json"
+jq -n '{arch:"x86_64",kernel:"linux-omarchy 7.2.8-9",module:"tuxedo-drivers-nocompatcheck-dkms 4.22.1-3",outcome:"passed",detail:""}' >"$tmp/report/1.json"
+jq -n '{arch:"x86_64",kernel:"linux-omarchy 7.2.8-9",module:"macbook12-spi-driver-dkms 0+git.315-2",outcome:"known-broken",detail:"known broken: why"}' >"$tmp/report/2.json"
+report() { "$ROOT/bin/check-dkms" report --legs "$tmp/legs.json" --results "$tmp/report" --url https://example.invalid/run --channel edge "$@" 2>"$tmp/stderr"; }
+out=$(report --plan success) || fail "report: $(cat "$tmp/stderr")"
+jq -e '.conclusion == "failure" and .title == "1/3 passed, 1 known broken, 1 failed"' <<<"$out" >/dev/null &&
+  jq -r .summary <<<"$out" | grep -qF '| no result | aarch64 | `linux-aurora 7.1.12.aurora7-2` | `xpadneo-dkms 0.10.4-1.1` | `the leg left no result` |' &&
+  pass "a leg without a result fails the run, and the title counts passed, known broken and failed" || fail "report: $out"
+jq -n '{arch:"aarch64",kernel:"linux-aurora 7.1.12.aurora7-2",module:"xpadneo-dkms 0.10.4-1.1",outcome:"passed",detail:""}' >"$tmp/report/3.json"
+out=$(report --plan success)
+jq -e '.conclusion == "success" and .title == "2/3 passed, 1 known broken"' <<<"$out" >/dev/null &&
+  jq -r .summary <<<"$out" | sed -n '1p' | grep -qF '**2/3 passed, 1 known broken** on edge.' &&
+  pass "known broken legs do not fail the run" || fail "known broken run: $out"
+out=$(report --plan failure)
+jq -e '.conclusion == "failure" and .title == "The DKMS plan did not finish"' <<<"$out" >/dev/null &&
+  pass "a plan that failed fails the run" || fail "plan failed: $out"
+echo '[]' >"$tmp/no-legs.json"
+out=$("$ROOT/bin/check-dkms" report --legs "$tmp/no-legs.json" --results "$tmp/report" --plan success --note "This build ships no kernel or DKMS package")
+jq -e '.conclusion == "success" and .title == "Nothing to check" and (.summary | startswith("This build ships no kernel or DKMS package."))' <<<"$out" >/dev/null &&
+  pass "a run without legs has nothing to check, and says why" || fail "no legs: $out"
+printf '%s\n' '[{"arch":"x86_64","kernel":"@omacom/core https://attacker.invalid","module":"evil|<img src=x>[a](https://x)`b`"}]' >"$tmp/evil.json"
+out=$("$ROOT/bin/check-dkms" report --legs "$tmp/evil.json" --results "$tmp/report" --plan success)
+row=$(jq -r .summary <<<"$out" | tail -n 1)
+[[ $(tr -cd '|' <<<"$row" | wc -c) == 6 && $row != *'<'* && $row != *'['* ]] &&
+  [[ $row == '| no result | x86_64 | `@omacom/core https://attacker.invalid` | `evil  img src=x  a (https://x) b ` | `the leg left no result` |' ]] &&
+  pass "names from package metadata cannot add cells, HTML, links or mentions to the summary" || fail "escape: $row"
+
+# A kernel built with clang (linux-aurora) needs clang, llvm and lld: DKMS
+# builds its modules with LLVM=1. Read from the installed build tree.
+mkdir -p "$tmp/clang-build" "$tmp/gcc-build"
+printf '%s\n' 'CONFIG_CC_VERSION_TEXT="clang version 18.1.8"' 'CONFIG_CC_IS_CLANG=y' 'CONFIG_LD_IS_LLD=y' >"$tmp/clang-build/.config"
+printf '%s\n' 'CONFIG_CC_IS_GCC=y' '# CONFIG_CC_IS_CLANG is not set' >"$tmp/gcc-build/.config"
+[[ $("$ROOT/bin/check-dkms" toolchain "$tmp/clang-build" 2>&1) == "clang llvm lld" ]] &&
+  pass "a kernel built with clang needs clang, llvm and lld" || fail "clang: $("$ROOT/bin/check-dkms" toolchain "$tmp/clang-build" 2>&1)"
+[[ -z $("$ROOT/bin/check-dkms" toolchain "$tmp/gcc-build" "$tmp/missing-build" 2>&1) ]] &&
+  pass "a kernel built with gcc, or one without a .config, needs nothing more" || fail "gcc: $("$ROOT/bin/check-dkms" toolchain "$tmp/gcc-build" 2>&1)"
+[[ $("$ROOT/bin/check-dkms" toolchain "$tmp/gcc-build" "$tmp/clang-build" 2>&1) == "clang llvm lld" ]] &&
+  pass "one kernel built with clang among several is enough" || fail "mixed"
+
+# run installs packages, so it must refuse to start without root. Checked only
+# when not root: as root it would really install them.
+if ((EUID != 0)); then
+  if "$ROOT/bin/check-dkms" run --arch x86_64 --channel edge >/dev/null 2>"$tmp/stderr"; then fail "run must refuse without root"; fi
+  grep -q 'as root in a disposable system' "$tmp/stderr" && pass "run refuses to install packages without root" || fail "root: $(cat "$tmp/stderr")"
+fi
+
+# A channel's Arch packages come from that channel's own snapshot on both
+# architectures, the mirrors build/Dockerfile builds against: an rc check on
+# aarch64 that read edge's mirror would test modules rc's machines never get.
+mirrors=$(
+  die() { echo "die: $*"; }
+  eval "$(sed -n '/^mirror_server() {/,/^}/p' "$ROOT/bin/check-dkms")"
+  for arch in x86_64 aarch64; do
+    for channel in edge rc stable; do echo "$arch $channel $(mirror_server "$channel")"; done
+  done
+)
+drifted=""
+while read -r arch channel server; do
+  grep -qF "Server = $server" "$ROOT/build/Dockerfile" || drifted+=" $arch:$channel"
+done <<<"$mirrors"
+[[ $(sort -u -k3 <<<"$mirrors" | wc -l) == 6 && -z $drifted ]] &&
+  pass "each channel reads its own Arch mirror on both architectures, as build/Dockerfile does" ||
+  fail "mirrors drifted from build/Dockerfile:${drifted:- two channels share one} ($mirrors)"
diff --git a/tests/dkms-check-workflow.cjs b/tests/dkms-check-workflow.cjs
new file mode 100644
index 0000000000..8c3051cdc9
--- /dev/null
+++ b/tests/dkms-check-workflow.cjs
@@ -0,0 +1,110 @@
+// The DKMS check's shape on a pull request: one check written through the
+// Checks API, never a job per kernel and module in the pull request's own
+// workflows, and no job that can write running anything from the repository.
+// workflow_run runs master's copy of dkms-check.yml after a pull request's
+// build, and GitHub's guidance for it is that a job holding a write token
+// must not check out or download what a pull request controls.
+const assert = require('node:assert/strict');
+const { readFileSync, readdirSync } = require('node:fs');
+const { test } = require('node:test');
+
+const dir = '.github/workflows';
+const read = name => readFileSync(`${dir}/${name}`, 'utf8');
+
+// Top-level trigger names under `on:`.
+function triggers(workflow) {
+  const on = workflow.split(/^on:\n/m)[1].split(/^\S/m)[0];
+  return [...on.matchAll(/^  ([a-z_]+):/gm)].map(match => match[1]);
+}
+
+// Each job's text, by id.
+function jobs(workflow) {
+  const body = workflow.split(/^jobs:\n/m)[1];
+  const parts = body.split(/^  (?=[a-z][a-z0-9_-]*:\n)/m).filter(Boolean);
+  return Object.fromEntries(parts.map(part => [part.slice(0, part.indexOf(':')), part]));
+}
+
+test('no workflow a pull request triggers fans the DKMS check out into its checks', () => {
+  for (const name of readdirSync(dir).filter(file => file.endsWith('.yml'))) {
+    const workflow = read(name);
+    if (!triggers(workflow).some(on => on === 'pull_request' || on === 'pull_request_target')) continue;
+    assert.doesNotMatch(workflow, /uses: \.\/\.github\/workflows\/dkms-/, `${name} must not call the DKMS matrix`);
+  }
+  for (const name of ['dkms-check.yml', 'dkms-matrix.yml']) {
+    assert.ok(!triggers(read(name)).some(on => on.startsWith('pull_request')), `${name} must not run on pull requests`);
+  }
+});
+
+test('the pull request check is written by jobs that run nothing from the repository', () => {
+  const all = jobs(read('dkms-check.yml'));
+  const writers = Object.entries(all).filter(([, job]) => /^\s+(checks|contents|pull-requests|actions|packages|statuses): write$/m.test(job));
+  assert.deepEqual(writers.map(([id]) => id).sort(), ['report', 'target']);
+  for (const [id, job] of writers) {
+    assert.doesNotMatch(job, /actions\/checkout|download-artifact|upload-artifact|actions\/cache/, `${id} must not check out or move artifacts`);
+    assert.doesNotMatch(job, /\bbin\/|\bhelpers\/|\.\/|source /, `${id} must not run repository code`);
+    // Values reach the script through env, never ${{ }} inside run:.
+    const script = job.split(/^\s+run: \|\n/m)[1] ?? '';
+    assert.doesNotMatch(script, /\$\{\{/, `${id}'s script must take its values from env`);
+    assert.doesNotMatch(job, /secrets\./, `${id} must not use secrets`);
+  }
+  assert.match(all.target, /checks: write/);
+  assert.match(all.report, /checks: write/);
+});
+
+test('the matrix only reads, and holds no secret', () => {
+  const workflow = read('dkms-matrix.yml');
+  assert.doesNotMatch(workflow, /: write$/m);
+  assert.doesNotMatch(workflow, /secrets\./);
+  for (const [id, job] of Object.entries(jobs(workflow))) {
+    assert.match(job, /persist-credentials: false/, `${id} must not keep the token in its checkout`);
+  }
+});
+
+test('a promotion stops when the channels moved after its DKMS check', () => {
+  const matrix = read('dkms-matrix.yml');
+  assert.match(matrix, /^      legs:\n.*\n        value: \$\{\{ jobs\.plan\.outputs\.legs \}\}$/m, 'the matrix hands its legs to the caller');
+  const promote = jobs(read('promote.yml')).promote;
+  assert.match(promote, /^    needs: dkms$/m);
+  assert.match(promote, /group: publish/, 'the comparison runs under the publish lock');
+  const compare = promote.indexOf('name: Check that the channels still hold what the DKMS check built');
+  const publish = promote.indexOf('name: Promote');
+  assert.ok(compare > 0 && compare < publish, 'the comparison comes before the promotion');
+  assert.match(promote, /CHECKED: \$\{\{ needs\.dkms\.outputs\.legs \}\}/);
+  assert.match(promote, /bin\/check-dkms matrix --arch x86_64 "\$\{args\[@\]\}"/);
+  assert.match(promote, /bin\/check-dkms matrix --arch aarch64 "\$\{args\[@\]\}"/);
+  assert.match(promote, /if \[\[ \$now != "\$built" \]\]; then/);
+});
+
+test('a pull request build records what the DKMS check reads', () => {
+  const build = read('build-pr.yml');
+  const changes = jobs(build).changes;
+  assert.match(changes, /name: dkms-request/);
+  assert.match(changes, /trusted: \(\$trusted == "true"\), matrix: \$matrix, reused: \$reused/);
+  assert.doesNotMatch(jobs(build).result, /dkms/, '`result` no longer waits for the DKMS check');
+});
+
+test('a build the check ignores, or one of an older commit, cannot cancel the head\'s check', () => {
+  const workflow = read('dkms-check.yml');
+  const group = workflow.split(/^concurrency:\n/m)[1].split(/^\S/m)[0];
+  assert.match(group, /format\('sha-\{0\}', github\.event\.workflow_run\.head_sha\)/, 'pull request builds are keyed by commit');
+  assert.match(group, /format\('ignored-\{0\}', github\.run_id\)/, 'ignored builds get a group of their own');
+  assert.match(group, /github\.event\.workflow_run\.path == '\.github\/workflows\/build-pr\.yml'/,
+    'a same-named workflow is ignored here as it is in target');
+  assert.doesNotMatch(group, /head_branch/, 'never by branch, which an older commit shares');
+});
+
+test('a fork that changes build-pr.yml is refused, not checked on its own word', () => {
+  const all = jobs(read('dkms-check.yml'));
+  // Provenance from the build run, in every mode, through checked commands:
+  // no pipeline whose failure reads as "not changed".
+  assert.match(all.target, /build=\$\(gh api "repos\/\$GITHUB_REPOSITORY\/actions\/runs\/\$run"\)/);
+  assert.match(all.target, /ours=\$\(blob "\$base"\)/);
+  assert.match(all.target, /theirs=\$\(blob "\$sha"\)/);
+  assert.match(all.target, /\$theirs != "\$ours"/);
+  // Only a 404 means "missing"; any other error fails the job.
+  assert.match(all.target, /elif \[\[ \$out == \*"\(HTTP 404\)"\* \]\]; then\n\s+echo missing\n\s+else\n[^\n]*\n\s+return 1/);
+  assert.doesNotMatch(all.target, /\| *grep -q/, 'grep -q in a pipeline fails open under pipefail');
+  assert.match(all.target, /refused: \$\{\{ steps\.open\.outputs\.refused \}\}/);
+  assert.match(all.dkms, /needs\.target\.outputs\.refused == ''/, 'a refused pull request runs no legs');
+  assert.match(all.report, /CONCLUSION=failure TITLE="Not checked"/, 'and its check fails');
+});