task-46: the front camera works — first frame captured, recipe recorded

docs/tasks/46-camera-imx363.md

@@ -3,6 +3,59 @@
 **Status:** rear sensor **written and building 2026-07-28**; the front pair was
 already wired. **Repo:** `Pixel3Arch` (kernel DT).
 
+## THE FRONT CAMERA WORKS — first frame captured 2026-07-29
+
+No reboot, no new kernel, no DT change. On the **running** kernel
+(`7.1.1-sdm845-g2bb09876e66a`) the whole front path was already live and
+nobody had tried it: `qcom_camss` and `imx355` loaded, `/dev/media0` +
+`/dev/video0..13`, and **both** front sensors bound and linked
+`ENABLED,IMMUTABLE` — `imx355 17-001a` -> `msm_csiphy1`, `imx355 17-0010` ->
+`msm_csiphy2`. The sensor advertises exactly one format,
+`SRGGB10_1X10/3280x2464`.
+
+Captured a real 10,131,968-byte frame off `/dev/video0` and debayered it: a
+ceiling, a curtain rail with the curtains drawn, a doorframe, a smoke
+detector. Correct geometry, correct colour, sane noise. **This device has now
+produced a camera image.**
+
+### The exact recipe (RDI raw path, no ISP)
+
+```sh
+M=/dev/media0
+media-ctl -d $M -l '"msm_csiphy1":1 -> "msm_csid0":0 [1]'
+media-ctl -d $M -l '"msm_csid0":1 -> "msm_vfe0_rdi0":0 [1]'
+F='[fmt:SRGGB10_1X10/3280x2464]'
+for p in '"imx355 17-001a":0' '"msm_csiphy1":0' '"msm_csiphy1":1' \
+         '"msm_csid0":0' '"msm_csid0":1' '"msm_vfe0_rdi0":0' '"msm_vfe0_rdi0":1'; do
+  media-ctl -d $M -V "$p $F"
+done
+v4l2-ctl -d /dev/video0 --set-fmt-video=width=3280,height=2464,pixelformat=pRAA
+v4l2-ctl -d /dev/video0 --stream-mmap --stream-count=1 --stream-to=/tmp/frame.raw
+```
+
+Gotchas that cost time, so they are written down:
+
+- The node is **Video Capture Multiplanar**. `RG10` is rejected; the format
+  that matches SRGGB10 is **`pRAA`** (10-bit Bayer RGRG/GBGB *Packed*).
+- **The row stride is 4112, not 4100.** 3280 px x 10 bits = 4100 bytes of
+  payload; the driver pads each row to 4112. Reshaping by 4100 shears the
+  image diagonally and looks like a broken sensor.
+- MIPI RAW10 packing: 4 pixels per 5 bytes — bytes 0-3 are the high 8 bits,
+  byte 4 packs the four low bit-pairs, pixel `i` taking `(b4 >> 2i) & 3`.
+- Black level is ~64 in 10-bit (the `0x10` floor visible in a raw hexdump).
+  Subtract it before scaling or everything is a flat grey field.
+- **`cam` / `qcam` (libcamera) are NOT installed.** `media-ctl` and `v4l2-ctl`
+  are. There is no auto-exposure running, so the frame is whatever the sensor's
+  power-on defaults give — dark indoors, and that is expected, not a fault.
+
+### What this changes
+
+The rear IMX363 DT work (`c7784b716`, branch `mic-race-fix`) is still worth
+finishing, but it is no longer the blocker for "does this phone have a camera".
+Next real steps are exposure/gain controls (`v4l2-ctl --list-ctrls` on the
+sensor subdev), then libcamera so something other than a shell script can open
+it, then TASK-12's face-auth question.
+
 ## What was actually missing
 
 A first pass at this said blueline's DT declared no camera at all. Wrong — that