RC3 (v2026.11.07-rc3)

RC3 release note (v2026.11.07-rc3)

RC3 is the third release candidate of the open camera stack (OpenIMP libimp + open-tx-isp kernel driver). It is cut when the RC3 gate of docs/status/release.yaml is green: (a) every vendor function that a streamer (timps, prudynt, raptor) calls works on every gate SoC (T10, T20, T21, T23, T30, T31, T40, T41; API cell dev, dev+, run, rt, a matched vendor no-op, or nohw by decision), (b) no open issue with severity critical or high, and (c) no open issue in the RC3 milestone. State on 2026-11-07: gate green, 2017 of 2017 streamer-function cells work, 0 blocking issues. RC3 opens the Release 1 window: the image built from the RC3 tag must then run 14 days without an unplanned reset on at least one camera per gate SoC. Issue numbers refer to https://github.com/Lu-Fi/openimp/issues. Full details: CHANGELOG.md of both repositories, docs/FEATURE_MATRIX.md, docs/OPENIMP_BEYOND_VENDOR.md.

Changes since RC2 (v2026.10.25-rc2)

All SoCs / tooling

• API test app openimp-apitest on every SoC, device evidence per API cell, coverage check in make check (every vendor function has a case or a documented reason)
• Machine-readable release gates, generated feature matrix with gate section, daily soak summary (make status-check, make status-soak)
• Fallback frame when the sensor stops (T40/T41, default on) and a reuse marker for stand-in JPEGs (OpenIMP_Encoder_StreamIsReused)
• FrameSource software rotation: cheaper C kernel, optional no-copy-back spares (OPENIMP_FS_ROTATE_SPARES, one consumer per channel), rotation capability marker OpenIMP_Cap_FsRotate / OpenIMP_FS_RotateLimits (#212, #219)
• Optional ISP bypass graphs (RAW channel) on T23, T30, T31, T41, default off (#125, #129, #218)
• Encoder sleeps on the frame-ready event on T10/T20/T21/T23 (encoder thread CPU -30 to -48 %) (#151)
• SU_Base_Shutdown vendor-equal (#206); FrameSource teardown stall watch in the test app (#198)
• Kernel: unused ISP interrupt sources masked on T23/T31, Linux 7.x build and runtime fixes, libgcc-helper guard for module builds

T10 / T20 / T21

• Decoder IMP_Decoder_* as a software JPEG decoder (#3, #5, #7)
• Encoder backlog closed: SetChnHSkip / BlackEnhance / scene-cut IDR, SetChangeRef, SetChnDemask, SetFisheyeEnableStatus, Get/SetH264TransCfg, SetChnRcTrigLevel as the vendor library (#3, #5, #7)
• T20: macroblock rate control on by default, FIXQP I pictures at QP - 3, I-aware CBR P budget (default on, extra) (#191)
• T10/T20 software rotation envelope = T21 (704x576, multiples of 16)
• T21: SetFrameDepth no longer sends a stray ioctl (#205)
• Driver reviews (#220, #221, #222, #231): fewer high-order allocations, T10/T20 module RAM about -20 KB (bring-up trace parameters only with TX_ISP_TRACE=y), IQ bin checked before it replaces the tables in use (extra), firmware semaphore re-init without use-after-free, T21 VIC error IRQ no longer writes the NULL page, T21 netlink/deinit serialised, T21 warn_stack (default off: no vendor stack dump after warnings, extra)

T23

• FrameSource software rotation 90/270 up to 1280x720 (beyond vendor); MXU2 never probed on T23 (#229)
• Optional ISP bypass graph OPENIMP_T23_BYPASS_GRAPH / isp_bypass_graph=1 (#129)
• API pass on both T23 cameras (13 cells moved), ISP OSD pictures and odd-width refusal, AutoZoom get (#127)
• Driver: AWB luminance threshold rewritten from the AE mean on every AWB interrupt like stock (source_awb_lum_th, #231); review: no idle IRQ threads, dead ISR chain unlinked, AWB statistics only when used (#224)

T30 (gate SoC since 2026-11-03, T30X lab camera)

• H.264 on the device at 2048x1536 / 1080p / 720p plus a 640x360 sub-stream; heights that are not a multiple of 16 encode again (#209)
• H.265 on the Radix encoder, vendor-equal CBR (within 0.1-2.4 %), 2048x1536 where the vendor delivers nothing; capability marker OpenIMP_Cap_H265, OPENIMP_T30_H265=0 off (#208)
• Live rate-control change on H.265 reads the H.265 attribute (was stuck at 361 kbit/s), vendor-equal on the device (#228)
• OEM picture rate controller (eprc T30 revision, bit-exact against the stock library) (#210, #219)
• Calm first stream window (extra beyond vendor, default on): start QP from bits per pixel, black start until the AE settled, start QP floor for the first GOP; first-2 s peak 1787 vs vendor 2671 kbit/s at 1080p15 CBR 2000 (#216)
• Software rotation through SetChnRotate (beyond vendor, MXU2) (#212); encoder ROI and super-frame as the vendor (#16, #19)
• ISP bypass graph device-proven: RAW 2048x1536 12-bit in 16 bits, then NV12 again (OPENIMP_T30_BYPASS_GRAPH=1) (#218)
• IMP_FrameSource_GetFrame compact NV12 like the vendor (#202); GetAFMetrices like the vendor; WaitFrame, RawDRC, antifog, mirror, picture controls, CSC presets (extra, opt-in) reach the driver
• Driver: tuning-bin customer init, system table, day/night bank reload, CCM light-source bank, sharpen coring, analog gain path, AWB_CWF_SHIFT set, Iridix strength fixes, direct raw writer for the bypass graph (#177, #202)

T31

• Optional ISP bypass graph OPENIMP_T31_BYPASS_GRAPH / isp_bypass_graph=1 (#129)
• GetChnEvalInfo record in the header layout; defog tables from the active tuning bin; isp_memopt=1 default; WDR output-mode getter, custom mode without a custom bin, sensor register access (#113, #117, #118)
• Driver review (#223, #231): module RAM -16 KB, no idle IRQ threads, "ch0 done" counted once, isp-w00/w01/fs show the VIC frame count, CSI shared-line handler fixed (extra)

T40 (open driver, Eufy T40XP / sc830ai)

• Vendor-equal picture in the fair light-box pass (#84): AE target, metering and exposure split as the OEM (#225), frame AE meters the hardware AE statistics (#232), AeTargetComp like the vendor (comp 40..200: Y 94..137 vs 92..142) (#232), antiflicker rung trade in the gain the sensor applies (#219), night antiflicker per tuning bank (night IT 215 / Y 79 vs 173 / 72)
• AWB: thresholds follow the total gain, bank refreshed on day/night switch (bit-exact thresholds, gains within 1 %); chroma NR repack threshold like the OEM, chroma noise vendor-equal (#213); CDNS day/night like the vendor (#203)
• Gamma EV follow-up (t40_gamma_ev, no-op on sc830ai) and WDR EV store (#204); CLM as the vendor (#85)
• The lifted colour chains (ADR, BCSH, CDNS, DPC, LCE, SDNS, YSP, CCM, DMSC, GIB, defog, AWB) are plain C, oracle-checked against the vendor module; unused lifted code removed (#85, #189, #193)
• AE/AWB algorithm callbacks (SetAeAlgoFunc / SetAwbAlgoFunc) change exposure and white balance (#65); AE tuning API on the frame AE; privacy mask and ISP draw on the scaled output (#186, #187)
• Release-gate oopses fixed, AWB close oops (#173), exit hardening, reload clean; streamer CPU 0.34 % vs 2.26 % on the vendor stack

T41

• Custom AE/AWB algorithm libraries (SetAeAlgoFunc, SetAwbAlgoFunc, extra beyond the vendor; released when the client dies) (#76, #195, #197)
• Optional ISP bypass RAW16 channel (OPENIMP_T41_BYPASS_GRAPH=1) (#125)
• ISP backlog closed: LDC / GPIO vendor no-op, StartNightMode, WDR_OPEN, ISP routes, AF statistics (t41_af=1), user gamma curve, ISP-drawn OSD, media memory pools / SetPool (#72, #75, #171, #179)
• SU_Base_SetWkupMode RTC proof (#80); 56 in-progress API cells checked on the two T41 cameras

Known limitations / not covered

• T23: the open AWB runs on every 4th ISP interrupt, the vendor on every interrupt (#233; needs a light-box proof).
• T30: picture quality (SSIM) against the vendor not measured; FixQP and SMART not run on the device; run-time frame-rate / GOP changes host-tested only; the start-QP map is fitted on the SC4236 only; DMIC rows count as nohw (no DMIC on the lab board, not verified on hardware).
• T40: only the sc830ai board is device-tested; at comp 200 the open analog gain stops at 4095 (vendor 5247); AO / AEC rows still in progress; on 7 of 37 shipped T40 bins t40_gamma_ev=1 changes the picture with the exposure (vendor behaviour).
• #94 (T31L) and #108 (T23) were closed after a 3 h debug-kernel stress without a reset (rule 2026-11-07); their causes stay unexplained and a recurrence re-opens them.
• T32 and T33 are planned / QEMU only and not part of RC3.
• Some API cells count at the evidence level "API round trip" (rt), e.g. DMIC_* on T31/T40/T41.

Upgrade notes

• OpenIMP environment variables, new since RC2 (default in brackets): OPENIMP_T30_START_QP (auto; vendor = start QP 26, or 10..51), OPENIMP_T30_BLACK_START (on; 0 off), OPENIMP_T30_START_FLOOR (on; 0 off), OPENIMP_T30_H265 (on; 0 disables H.265 and clears OpenIMP_Cap_H265), OPENIMP_T30_EPRC (on; 0 = old GOP controller), OPENIMP_T30_BYPASS_GRAPH / OPENIMP_T23_BYPASS_GRAPH / OPENIMP_T31_BYPASS_GRAPH / OPENIMP_T41_BYPASS_GRAPH (off; needs the driver's isp_bypass_graph=1 where it exists), OPENIMP_FS_ROTATE_SPARES (off), OPENIMP_MXU (on; 0 = C kernels only), OPENIMP_FALLBACK_FRAME (on, T40/T41) with OPENIMP_FALLBACK_TIMEOUT_MS, OPENIMP_HELIX_JPEG_BUSY_WAIT_MS (debug).
• open-tx-isp T40 module parameters, new since RC2 (default): t40_ae_target_oem (1), t40_ae_stats_src (0 = hardware statistics while they run), t40_ae_hi_thr (0 = bank), t40_ae_af_night_bin (1), t40_ae_split_legacy (0), t40_ae_trade_sensor_gain (1), t40_gamma_ev (1), t40_clm (1), t40_dn_keep_awb1 (1), t40_dmsc_day_follow (1), defog fixes t40_defog_* (1); changed default: cdns_thresh 256 (was 65536, bring-up builds only). Removed: t40_oem_ae and the T40 bring-up CLM / ISR-literal parameters.
• Other module parameters: T21 warn_stack (0), T23 source_awb_lum_th (1), T23/T31/T41 isp_bypass_graph (0), T31 isp_memopt default 1, T23/T31/T41 *_isr_enable masks. T10/T20: t20_trace, t10_runtime_trace / t20_runtime_trace, t20_trace_events are no longer built by default (TX_ISP_TRACE=y builds them); the 3.10 ker...

openimp v2026.10.25-rc2 (release candidate 2)

OpenIMP is an open replacement for Ingenic's closed libimp.so / libsysutils.so. With its companion open-tx-isp (open ISP kernel driver) it forms a fully open camera stack for Ingenic T-series SoCs; applications link against the vendor IMP API unchanged. Release together with open-tx-isp v2026.10.25-rc2; always use matching tags.

Read more (pinned to this tag)
Feature matrix	FEATURE_MATRIX.md · rendered HTML
Beyond the vendor stack	OPENIMP_BEYOND_VENDOR.md
Changelog	CHANGELOG.md · OPEN_STACK_CHANGELOG.md
Full release note	RELEASE_NOTES_RC2.md

---

Second release candidate of the open camera stack: OpenIMP (replacement for the vendor libimp.so / libsysutils.so) together with open-tx-isp (open ISP kernel driver). Always use matching tags: open-tx-isp v2026.10.25-rc2.

Previous	RC1 v2026.10.11-rc1: OpenIMP fe9307c, open-tx-isp 191be6c5 (RC1 note)
This release	OpenIMP next 7c30aa99 + documentation, open-tx-isp next 1bf4549d + documentation
Size of the change	OpenIMP 278 commits, open-tx-isp 636 commits since RC1
Feature matrix	FEATURE_MATRIX.md, rendered (cells new since RC1 carry an "RC2" badge, filter "only changes since RC1")
Beyond the vendor stack	OPENIMP_BEYOND_VENDOR.md
Full campaign log	OPEN_STACK_CHANGELOG.md, CHANGELOG.md

Status per SoC: T10, T20, T21, T23, T31 are release candidates as in RC1. T41 is complete against the matrix (all 39 applicable cells supported; RC1: 28 of 45 cells). T40 has 35 of 40 applicable cells supported (RC1: 6 of 45, 20 unknown); the rest are the three known limitations and the two audio cells below. T30 stays experimental (no camera in our lab).

Tested on

The exact RC2 code runs on all 19 cameras of the test fleet (since 2026-10-25 ~11:30, with the matching streamer build): T10, T20, T21, T23, T31 (X and L), T40, T41 (two sensors). Before that, the state of 2026-10-24 ran an overnight soak (2026-10-24 22:45 to 2026-10-25 10:00; T41 gc5603 and sc5336, T40 sc830ai, and the rest of the fleet on the previous image): 0 oopses, 0 encoder-dead events, snapshots always 200, no streamer restarts, memory flat. Vendor comparisons are A/B runs on the same camera where a vendor stack exists (T40 Eufy, T41 Vanhua/Cinnado, T31, T21).

T41

• Complete against the matrix (39 of 39 applicable cells supported, 4 of them beyond vendor; RC1: 28 supported, 4 defects, 7 missing): New or fixed since RC1: defog (root cause: the translated chain read its tables from the wrong rodata image; defog registers now equal the vendor dump), WDR/ADR/DRC ratios, DPC (true-dark test: no hot pixel left with DPC on), 2D noise reduction (night softness was the missing defog), CCM, gamma and CSC, live front crop (1920x1080 on ch0, up to 1280x720 on ch1), rotation, module reload (49 cycles in one boot, no oops, no leak; the vendor leaks a page per stream start), versioned encoder telemetry, ROI that also works under FixQP (the vendor shows no effect there), day/night with automatic return to day.
• Vendor-equal RC parameter APIs (SetDefaultParam identical for 40 profile/mode/QP cases, return codes, QP window clamp, run-time SetChnAttrRcMode semantics).
• Beyond vendor: OpenIMP_Encoder_GetTelemetry (frames, bytes, IDR count, encode time, fps, kbit/s) and a real IMP_Encoder_Query state; IMP_Encoder_SetAvpuBsShare plus the default stream count 2 (saves 2.7 MB video memory for 1080p + 360p); ISP interrupts 25-45 % below the vendor, streamer RSS 35-45 % below; about 4 % more free CPU than the vendor stack.
• Known limitations: module is 836 KB against the vendor 778 KB (accepted: extra functions); iIPDelta/iPBDelta/eRcOptions/uMaxPictureSize are stored only (under reverse engineering); a forced day mode leaves AWB at 5000 K.

T40

• Open driver now usable end to end (RC1: first device run on the vendor driver): the boot-time oops is fixed (stack overflow in the anti-flicker control), rmmod works (30/30 reload cycles, kill -9 and streamer restarts clean, restart leak of ~344 KB closed; the vendor module oopses on rmmod), framechannel freed when its client dies, crashes in the lifted tuning controls fixed (SetModuleControl, SetMask, SetWdrOutputMode, CCM/CSC/Gamma getters, SetScalerLv).
• Picture quality against the vendor stack (A/B on the Eufy sc830ai): AE (day luma 119 against 122, light step settles < 1 s), AWB (R/G 0.98, B/G 1.00 against 1.00/1.02), DRC/Sinter/Temper ratios (Temper uses the vendor formula), CSC and BCSH like the vendor, day/night with DMSC following the night bank (dark+IR p50 8 against vendor 11; before 25).
• Encoder: frame-level rate control, AVPU command lists as vendor 1.3.1, H.265 with hardware rate control, 4K HEVC FixQP within -1 % of the target, ROI, SEI, vendor-equal SetDefaultParam, telemetry. Audio input and IMP_AI volume/gain like vendor 1.3.1.
• Matrix: boot guard supported (dry run), libalog/libsysutils not needed, long-term stability supported (first overnight soak of the T40 stack). AO speaker and AEC: not RC2-relevant, sound tests pending.
• Known limitations (kept as defects in the matrix): manual CCM has only a small picture effect (#9); sharpness 4-5 % below the vendor (#12); motion-detection pans proven on the 2026-10-19 code but not re-tested on the final build (#29); module 404 KB (xz) against 230 KB vendor (lifted chains and diagnostics); HLC/BLC strength and ADR bypass have a small effect.

T31

• MIPS vector unit (MXU2) AWB statistics by default (t31_awb_impl=2): the AWB colour-temperature detection runs on the SoC vector unit after a load-time self-test, bit-exact with the reference C code, about 2.4x faster sweeps (fast C code if the self-test fails; t31_awb_impl=0/1 turn it off). Device-tested on a T31X and a T31L.
• Front crop can enlarge up to 2.0x by default (fcrop_upscale_pct=100); beyond that it is refused instead of hanging the MSCA. AE minimum EV step, defog tables and isp_memopt=1 stripe fix like the OEM; AWB statistics interrupt no longer uses a large stack buffer; ISP interrupt quiesce before request_irq on reload; CBR debt bound; mainline V4L2 sensor bridge and SC2336 (kernel >= 5.0).
• Known limitations: long-term stability stays a defect: one unexplained reboot on a T31L on 2026-10-17 (fork/allocator fault, mitigation merged) and one hang on the old agg43 image on 2026-10-25; a multi-day run of the current code ends on 2026-10-29.

T23, T21, T20, T10 and general

• T23: native Helix H.264 only (the OEM worker bridge is off by default: OPENIMP_T23_HELIX_BRIDGE=1 restores it); ISP interrupt quiesce before request_irq on reload. A reported "day after idle" was traced to the streamer's day/night probe, not to the driver.
• T21: sensor exposure/gain written only on change (i2c interrupts 50/s to 0-2/s); reload after streaming no longer livelocks (VIC parked on quiesce; QEMU-tested, not yet on a camera); per-frame Helix path at -O2.
• T10/T20: SetAntiFogAttr and SetMeshShadingScale like the vendor 3.12.0 library; SetChnRcTrigLevel.
• General: smaller libimp.so (-Os, debug code compiled out unless OPENIMP_DEBUG=1); OPENIMP_LOG_LEVEL; named threads for top -H; make release-check and make export-check (vendor export list comparison); SU_Base_Shutdown reboots busybox cameras; feature matrix of 45 features and 8 SoC columns with a rendered view that highlights the changes since RC1.
• Beyond the vendor stack (all SoCs, details in OPENIMP_BEYOND_VENDOR.md): reload and restart robustness (0 oops in repeated cycles), smaller library and module sizes, test pattern modes with runtime API (TESTPATTERN.md), T31 encoder ROI, per-stream telemetry, QEMU-based regression tests of the driver (found real bugs, e.g. the T40 ISR slot index and a pending interrupt at reload).

Upgrade notes (changed defaults and interfaces)

Area	Change
T41 defog	defog now works and t41_defog=1 is the default (RC1: refused; an intermediate state had it off because of a diamond artefact, fixed at the root)
T41 bring-up parameters	experiment switches and t41_tmo_map_selftest are built in only with TX_ISP_T41_BRINGUP_PARAMS=y / TX_ISP_T41_TMO_SELFTEST=y (default n); scripts that set such parameters must be updated
T40 bring-up parameters	340 experiment/diagnostic parameters and /proc/tx_isp_t40_recovered only with TX_ISP_T40_BRINGUP_PARAMS=y, TX_ISP_T40_DEBUG_PROC=y (default n); 288 parameters remain
T31 AWB	t31_awb_impl=2 (MXU...

openimp v2026.10.11-rc1 (release candidate 1)

OpenIMP is an open replacement for Ingenic's closed libimp.so / libsysutils.so (video, ISP tuning, encoder, OSD, IVS, audio and system API). With its companion open-tx-isp (the open ISP kernel driver replacing tx-isp-<soc>.ko) it forms a fully open camera stack for Ingenic T-series SoCs. The public API is the vendor IMP API, so applications link against it unchanged. Release together with open-tx-isp v2026.10.11-rc1; always use matching tags.

Read more (pinned to this tag)
Feature matrix (per function and SoC, open vs vendor)	FEATURE_MATRIX.md · rendered HTML
Beyond the vendor stack: integration notes and env switches	OPENIMP_BEYOND_VENDOR.md
Full campaign log with test evidence	OPEN_STACK_CHANGELOG.md
Condensed changelog · ROI rules	CHANGELOG.md · ROI.md

1. Summary

Component	Revision
OpenIMP	v2026.10.11-rc1 = fe9307c (soaked agg-35 code 687a68e4 + documentation only)
open-tx-isp	v2026.10.11-rc1 = 191be6c5 (soaked agg-35 code 6e464ac7 + documentation only)
thingino	aperto branch; the pin of packages openimp / open-tx-isp to v2026.10.11-rc1 is pending as a pull request

Scope: all OpenIMP changes since the start of the device-test campaign (base 9c6b0ba, 2026-09-29), 795 commits; about 195 of them are new since the previous aperto state (2026-10-06).

RC1 is exactly the code that ran the overnight soak below; only documentation changed afterwards. If no blocking problem is reported, the same code becomes the first dated release on aperto. Later work (agg-36) is not included (section 5).

SoC	Status	Encoders
T10, T20, T21	release	H.264 + HW JPEG on Helix/NVPU (T10 userspace = T20 build)
T23	release	native Helix H.264 (no vendor code at all) + HW JPEG; no HEVC hardware
T31 (reference)	release	H.264, H.265, HW JPEG on the AVPU
T30	experimental	H.264; no T30 device in our lab; an external contributor reported a live gate on a T30X (docs/T30_STATUS.md); test kit in tools/testkit/t30
T40	experimental	H.264; first device run only
T41	experimental	H.264, H.265; sub-stream geometry and night colour open

Completeness (vendor IMP/SU functions per SoC, from the feature matrix at this tag; "done" = device-tested + host-tested + audited, "gaps" = cache-only, stub, error or missing):

SoC	Vendor functions	Done	Gaps	Status
T10	325	89.2 %	32	release
T20	325	90.5 %	30	release
T21	325	93.2 %	14	release
T23	437	93.8 %	15	release
T31	387	96.4 %	8	release
T30	347	n/a (no device; 293 not audited)	54	experimental
T40	398	25.4 % (177 not audited/run yet)	120	experimental
T41	445	59.3 %	179	experimental

Work after RC1 (agg-36) raises T30/T40/T41 further and closes many of these gaps (T40 OSD/ISP-OSD/SwitchBin/bufshare, T41 zoom/mask/scaler level).

2. Release evidence

Overnight soak of the RC1 code (2026-10-10 18:04 to 2026-10-11 08:00, about 14 h, 10 cameras: T10, T20 x2, T21 x2 (one running the vendor stack as reference), T23 x3, T31, T41; full OTA images on thingino aperto, each running a streaming application): 0 kernel oopses, 0 unexplained reboots, 0 application restarts, VA-API decode check 54/54. The previous soak of this line (agg-32, 43.4 h) had 0 unplanned reboots and 0 oopses on the cameras without user interaction; the problems it found (T31 front-crop crash, T20 day/night) are fixed here.

Release gate (apitest = one call per vendor function, imgfx = one picture per image function): every FAIL fixed or explained.

SoC	apitest	Remaining FAILs
T20 (2 cams)	212 PASS / 0 FAIL	– (GetAeZone N/A: not served by the stock module)
T21 (2 cams)	228 / 0	– (33 FAILs before the frame-source fixes)
T23	304 / 4	the 4 AF getters; pass since AF statistics are on by default
T31	274 / 1	H.264 stall after JPEG teardown; fixed (per-channel PollingStream serialisation), FAIL 0
T10 / T20 / T21, gap run 2026-10-10	147 / 148 / 155 PASS	T10 1: SetSuperFrameCfg read-back differs, the setting is applied (known minor issue)
T41 (experimental)	260 / 9	driver work and a tool; audio mute since done in software

imgfx: no open FAIL. Colour functions verified in daylight on T20/T23/T31 by the QA of 2026-10-10 (colour effects B/W, negative, sepia, vivid, AE compensation, crop and ROI: PASS 35/27/36 checks; the only FAIL was a QA threshold artefact, B/W saturation 25.02 % against a 25 % limit, fixed in the QA). T10/T21 colour functions were checked under lamp light or at night only. The 2026-10-10 additions (T23 ROI, T40 run, T41 controls, audio/AEC on five SoCs) were device-tested before the soak; agg-34 passed a streaming smoke test on 9 cameras (50/50).

Host tests: make check (about 100 test programs) green on all SoCs, cross-builds pass; rate-control oracles (eprc 0 deviations against the vendor; T31 Allegro core state-identical against 20 vendor traces and 72 x 400 random frames); ROI validity over 20 000 random window sets; motion v2 bit-identical to the vendor with OPENIMP_MOTION_V2=0.

Below, [host] marks items without a device test; everything else was device-tested on the SoC named.

3. Highlights by area

ISP and tuning

• Controls the vendor ignores now act: T21 brightness (via AE target; 30/128/225 give luma 28.8/117.7/193.0, 128 = vendor picture), sepia, scene/colour effects and ae_it_max_us; Sinter/Temper strength on T21/T20/T10; T23 brightness/contrast/saturation/hue and immediate SetGamma.
• Full T23 1.3.0 tuning API; T31/T23 control IDs and ABI as in the stock firmware; 19 T23 getters routed; AF statistics/getters on T23 and T31.
• T31 stack overruns fixed (GetAfHist, Get/SetAeAttr, GetAwbZone), GetAWBCt, EnableDefog flag, SetFrameDrop with stock semantics (ISP drops the frames).
• T10/T20: vendor control IDs and pointer semantics, Get/SetIntegrationTime, SetDPStrength, Get/SetISPHVflip, Get/SetWDRAttr like the 3.12.0 libimp; front crop and CSC presets (beyond vendor).
• Unknown controls return an error instead of a silent success; getters return what was set.
• T41: gamma, CCM, CSC presets/user tables, manual exposure, module control/ratios, frame drop, sensor register, AF weight, WDR enable. T40: tuning Get calls device-tested, Set calls [host].

AE, AWB, day/night

• T20/T10 day/night fixed with the driver: isp-m0 reports the analog gain cap the AE really reaches (T20 128 instead of 158; T10 the stepped plateau). Confirmed on a T20 camera: correct switch to Night at dusk and back to Day in the morning (ISP confirmed) in the agg-34 soak; both T20 cameras stayed correct through the RC1 soak.
• T20/T21 re-send image controls on day/night like the vendor; T23 keeps white balance across stream restarts (no green snapshots); T21 AWB hysteresis at dusk.
• SetAeComp: T20 monotonic; T31 OEM formula but slow AE (allow about 30 s to settle).

Encoder

• T31: real HEVC; vendor Allegro rate-control core (VBR closed loop, CappedVBR/CappedQuality with the 42 dB cap, CBR); H.264 recovery instead of freezes.
• T23: native Helix H.264 by default (no vendor libimp/helper), overflow handling, sub-stream rotation, YuvSetCrop. T21/T23: vendor eprc controller ported (0 oracle deviations). T20/T10: OEM controllers by default, I-aware CBR budget, T10 super-frame fix (re-encodes 800 to 0).
• H.265 on SoCs without HEVC (T10/T20/T21/T23) fails at CreateChn instead of creating a channel that never encodes.
• ROI: T31 gets an ROI the vendor T31 library lacks (SetChnRoiAttr, AVPU QP table, H.264); T21 and T23 SetChnROI really programmed; T10/T20 ROI and chroma QP offset. Every path stays valid H.264 (deltas clamped to -25..+25; -26 used to break hardware decoders). T41 ROI code only, off.
• JPEG: hardware JPEG on T31 (AVPU, CPU load 70 % to 17 % at 1 snapshot/s) and T20/T21/T23 (Helix, about 95 % less CPU); quality applied; a JPEG channel feeds itself when its video channel is not polled.
• GetFd (pollable pipe), InsertUserData SEI, PollingModuleStream bitmap, vendor channel statistics, effective-RC log line, QP/fps clamp warnings, Helix encoder error limit, vendor denoise semantics on T20/T21.
• T40: H.264 on two channels with correct timestamps, software JPEG snapshots.

Frame source

• GetFrame/SnapFrame wait up to 2 s like the vendor; T20 apps that set a frame depth get frames again; delay FIFO and GetTimedFrame.
• Software rotation 90/270 (T31; T10/T20/T21/T23 sub-streams); front crop on all release SoCs.
• T21/T23 keep a disabled channel's pool for its next start (40 T23 stream restarts, every snapshot OK); many lifecycle races fixed.

OSD · drawn on T20/T21/T30 (vendor never drew on the Helix path) and by the T31 IPU (also in HW JPEG snapshots); lines, rectangles, bitmaps; T23 OSD ABI and stride fix; first T21 snapshot waits for its OSD; T40 PIC and COVER.

IVS · real motion detection on T20/T21/T30 (vendor: always "no motion"); motion v2 on by default (background model, suppression after IR/gain jumps, objects with bounding boxes via OpenIMP_IVS_MoveGetResultEx; overni...