diff --git a/.github/workflows/build-core.yml b/.github/workflows/build-core.yml
index 261a6e8..fc92acb 100644
--- a/.github/workflows/build-core.yml
+++ b/.github/workflows/build-core.yml
@@ -128,6 +128,10 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
+      # Optional preset-scoped overlays (e.g. pa-gr/vauxite Clang 22). No-op for other sources.
+      - name: Apply kernel source-local patches
+        run: bash scripts/apply-kernel-source-patches.sh
+
       - name: Check runner disk space
         id: disk-space
         run: |
@@ -275,6 +279,8 @@ jobs:
           source release/resolved-refs.env
           config_hash="$(sha256sum scripts/build-kernel.sh config/marble.env config/managers.json \
             config/susfs-refs.json config/kernel-sources.json scripts/resolve-kernel-source.sh \
+            scripts/apply-kernel-source-patches.sh \
+            $(find patches/kernel-sources -type f 2>/dev/null | sort || true) \
             | sha256sum | cut -d' ' -f1)"
           toolchain_id="${ACTIVE_TOOLCHAIN_ID:-${TOOLCHAIN}}"
           lto_mode="${LTO:-thin}"
diff --git a/.github/workflows/build-matrix.yml b/.github/workflows/build-matrix.yml
index 2f6149c..6536ce0 100644
--- a/.github/workflows/build-matrix.yml
+++ b/.github/workflows/build-matrix.yml
@@ -47,7 +47,8 @@ on:
           - melt
           - lineageos
           - evolution-x
-          - pablo
+          - aosp-pablo
+          - pa-gr
       source_ref:
         description: "Override branch/tag/commit (empty = preset default)"
         required: false
diff --git a/README.md b/README.md
index de0f09f..6ee31c1 100644
--- a/README.md
+++ b/README.md
@@ -49,7 +49,7 @@
 
 | Feature | Description |
 |--------|-------------|
-| 🧬 **Multi-kernel sources** | Dropdown: Melt (HyperOS), LineageOS, Evolution-X, Pablo (LOS-based) |
+| 🧬 **Multi-kernel sources** | Dropdown: Melt (HyperOS), LineageOS, Evolution-X, aosp-pablo, pa-gr (LOS-based) |
 | 🤖 **Multi-manager builds** | KernelSU, KernelSU-Next, SukiSU Ultra, ReSukiSU, or a clean no-root baseline |
 | 🛡️ **SUSFS integration** | Optional SUSFS (`v2.2.0` / `v2.1.0` / custom) for supported managers |
 | 🔗 **Selectable LTO** | `none` · `thin` (default) · `full` — free-runner hardened for thin |
@@ -89,7 +89,8 @@ Named after the project / author. Pick one in **Build Marble Kernel**:
 | `melt` | Melt | [`mohdakil2426/android_kernel_xiaomi_marble`](https://github.com/mohdakil2426/android_kernel_xiaomi_marble) | `melt-rebase` | Stock **HyperOS** |
 | `lineageos` | LineageOS | [`LineageOS/android_kernel_xiaomi_sm8450`](https://github.com/LineageOS/android_kernel_xiaomi_sm8450) | `lineage-23.2` | **LOS-based** custom ROMs only |
 | `evolution-x` | Evolution-X | [`Evolution-X-Devices/kernel_xiaomi_sm8450`](https://github.com/Evolution-X-Devices/kernel_xiaomi_sm8450) | `cnb` | **LOS-based** custom ROMs only |
-| `pablo` | Pablo | [`aosp-pablo/android_kernel_xiaomi_sm8450`](https://github.com/aosp-pablo/android_kernel_xiaomi_sm8450) | `16` | **LOS-based** custom ROMs only |
+| `aosp-pablo` | aosp-pablo | [`aosp-pablo/android_kernel_xiaomi_sm8450`](https://github.com/aosp-pablo/android_kernel_xiaomi_sm8450) | `16` | **LOS-based** custom ROMs only |
+| `pa-gr` | pa-gr | [`pa-gr/android_kernel_xiaomi_sm8450`](https://github.com/pa-gr/android_kernel_xiaomi_sm8450) | `vauxite` | **LOS-based** custom ROMs only |
 
 - **HyperOS (`melt`)** uses `marble_defconfig` and Android `clang-r416183b` via `toolchain=auto`.
 - **LOS-family kernels** merge `gki_defconfig` + vendor GKI fragments; `toolchain=auto` selects **`llvm-22.1.8`** (armv9). Prefer **`lto=thin`** on free runners.
@@ -102,7 +103,8 @@ Named after the project / author. Pick one in **Build Marble Kernel**:
 | `melt` | `auto` → `android-r416183b` | `thin` | HyperOS-oriented |
 | `lineageos` | `auto` → `llvm-22.1.8` | `thin` | Required for armv9 |
 | `evolution-x` | `auto` → `llvm-22.1.8` | `thin` | LOS-family |
-| `pablo` | `auto` → `llvm-22.1.8` | `thin` | LOS-family |
+| `aosp-pablo` | `auto` → `llvm-22.1.8` | `thin` | LOS-family |
+| `pa-gr` | `auto` → `llvm-22.1.8` | `thin` | LOS-family; default `vauxite` has in-tree KernelSU — smoke-test manager apply |
 
 **Free runners:** avoid many parallel LOS+LLVM jobs; prefer 1–2 heavy builds at a time. Prefer `lto=thin`, not `full`.
 
@@ -117,7 +119,7 @@ AK3_marble_<FAMILY>_<source>_<manager>[-version][-codeN][_susfs-vX.Y.Z]_rN.zip
 | FAMILY | Sources |
 |--------|---------|
 | `MELT` | `melt` |
-| `LOS` | `lineageos`, `evolution-x`, `pablo` |
+| `LOS` | `lineageos`, `evolution-x`, `aosp-pablo`, `pa-gr` |
 
 LTO and toolchain are **not** in the filename (see flash banner + `build-info.*`).
 
@@ -188,7 +190,7 @@ Do **not** enable SUSFS with `none` or `kernelsu`.
 ### Quick start — build
 
 1. Open **[Actions → Build Marble Kernel → Run workflow](https://github.com/mohdakil2426/marble-kernel-builder/actions)**
-2. Choose **kernel source** (`melt` / `lineageos` / `evolution-x` / `pablo`)
+2. Choose **kernel source** (`melt` / `lineageos` / `evolution-x` / `aosp-pablo` / `pa-gr`)
 3. Select manager checkbox(es)
 4. Set **lto** (default `thin`), SUSFS, optional `source_ref`, **toolchain** (LOS → `llvm-22.1.8`), scope
 5. Run · download artifacts when green
@@ -219,7 +221,7 @@ Do **not** enable SUSFS with `none` or `kernelsu`.
 | `enable_susfs` | `false` | Enable SUSFS for managers that support it |
 | `susfs_version` | `v2.2.0` | `v2.2.0` · `v2.1.0` · `custom` |
 | `susfs_ref` | *(empty)* | Branch/tag/commit — only with `custom` |
-| `kernel_source` | `melt` | Dropdown: `melt` · `lineageos` · `evolution-x` · `pablo` |
+| `kernel_source` | `melt` | Dropdown: `melt` · `lineageos` · `evolution-x` · `aosp-pablo` · `pa-gr` |
 | `source_ref` | *(empty)* | Optional branch/tag/commit override (preset default if empty) |
 | `build_scope` | `image-only` | `image-only` or `full` |
 | `toolchain` | `android-r416183b` | `android-r416183b` (default) or experimental `llvm-22.1.8` |
@@ -266,7 +268,7 @@ marble-flash-<label>-<scope>-r<run>/
 AK3_marble_MELT_melt_ksunext-v3.2.0-code33203_susfs-v2.2.0_r121.zip
 AK3_marble_LOS_lineageos_ksunext-v3.2.0-code33203_susfs-v2.2.0_r121.zip
 AK3_marble_LOS_evolution-x_sukisu-v4.1.3-code40813_susfs-v2.2.0_r122.zip
-AK3_marble_LOS_pablo_resukisu-v4.1.0-code34990_r123.zip
+AK3_marble_LOS_aosp-pablo_resukisu-v4.1.0-code34990_r123.zip
 AK3_marble_MELT_melt_noroot_r124.zip
 ```
 
@@ -329,7 +331,7 @@ Full pin table: [`docs/versions.md`](docs/versions.md)
 
 **2026-07-12** — multi-kernel smoke (`build_none`, `image-only`)
 
-- Melt / LineageOS / Evolution-X / Pablo — [29189567468](https://github.com/mohdakil2426/marble-kernel-builder/actions/runs/29189567468) … [29192972075](https://github.com/mohdakil2426/marble-kernel-builder/actions/runs/29192972075)
+- Melt / LineageOS / Evolution-X / aosp-pablo — [29189567468](https://github.com/mohdakil2426/marble-kernel-builder/actions/runs/29189567468) … [29192972075](https://github.com/mohdakil2426/marble-kernel-builder/actions/runs/29192972075)
 
 **2026-06-22** — Melt device boot: KernelSU-Next / SukiSU Ultra / ReSukiSU + SUSFS v2.2.0 (r46–r48)
 
@@ -372,7 +374,8 @@ On A/B devices, target the correct slot (or both if needed).
 | 📱 Melt / HyperOS kernel | [mohdakil2426/android_kernel_xiaomi_marble](https://github.com/mohdakil2426/android_kernel_xiaomi_marble) |
 | 🟠 LineageOS SM8450 | [LineageOS/android_kernel_xiaomi_sm8450](https://github.com/LineageOS/android_kernel_xiaomi_sm8450) |
 | 🧬 Evolution-X SM8450 | [Evolution-X-Devices/kernel_xiaomi_sm8450](https://github.com/Evolution-X-Devices/kernel_xiaomi_sm8450) |
-| 🧩 Pablo SM8450 | [aosp-pablo/android_kernel_xiaomi_sm8450](https://github.com/aosp-pablo/android_kernel_xiaomi_sm8450) |
+| 🧩 aosp-pablo SM8450 | [aosp-pablo/android_kernel_xiaomi_sm8450](https://github.com/aosp-pablo/android_kernel_xiaomi_sm8450) |
+| 🧪 pa-gr SM8450 | [pa-gr/android_kernel_xiaomi_sm8450](https://github.com/pa-gr/android_kernel_xiaomi_sm8450) (`vauxite`) |
 | 🫙 AnyKernel3 | [osm0sis/AnyKernel3](https://github.com/osm0sis/AnyKernel3) |
 | 🔐 KernelSU | [tiann/KernelSU](https://github.com/tiann/KernelSU) |
 | 🚀 KernelSU-Next | [KernelSU-Next/KernelSU-Next](https://github.com/KernelSU-Next/KernelSU-Next) |
@@ -391,7 +394,7 @@ On A/B devices, target the correct slot (or both if needed).
 
 | Project / person | Contribution |
 |------------------|--------------|
-| **Kernel source maintainers** | Melt, LineageOS, Evolution-X, Pablo trees used as clean presets |
+| **Kernel source maintainers** | Melt, LineageOS, Evolution-X, aosp-pablo trees used as clean presets |
 | **osm0sis** | AnyKernel3 flashing framework |
 | **tiann** | KernelSU |
 | **KernelSU-Next team** | KernelSU-Next |
diff --git a/config/kernel-sources.json b/config/kernel-sources.json
index 8883b9a..81521c8 100644
--- a/config/kernel-sources.json
+++ b/config/kernel-sources.json
@@ -49,14 +49,14 @@
     "recommended_toolchain": "llvm-22.1.8",
     "notes": "Evolution-X device org SM8450 kernel for marble. Prefer clean branches without in-tree KSU. Needs llvm-22.1.8 (armv9 flags)."
   },
-  "pablo": {
-    "display": "Pablo",
-    "author": "Pablo",
+  "aosp-pablo": {
+    "display": "aosp-pablo",
+    "author": "aosp-pablo",
     "repo": "aosp-pablo/android_kernel_xiaomi_sm8450",
     "default_ref": "16",
-    "rom_label": "Pablo",
+    "rom_label": "aosp-pablo",
     "rom_family": "los",
-    "rom_support": "Pablo / LOS-based custom ROMs only",
+    "rom_support": "aosp-pablo / LOS-based custom ROMs only",
     "defconfig_mode": "gki_fragments",
     "base_defconfig": "gki_defconfig",
     "config_fragments": [
@@ -66,6 +66,31 @@
       "vendor/debugfs.config"
     ],
     "recommended_toolchain": "llvm-22.1.8",
-    "notes": "aosp-pablo SM8450 kernel (Marble Development). LOS-based custom ROMs only. Needs llvm-22.1.8 (armv9 flags)."
+    "notes": "GitHub org aosp-pablo SM8450 kernel (Marble Development). LOS-based custom ROMs only. Needs llvm-22.1.8 (armv9 flags)."
+  },
+  "pa-gr": {
+    "display": "pa-gr",
+    "author": "pa-gr",
+    "repo": "pa-gr/android_kernel_xiaomi_sm8450",
+    "default_ref": "vauxite",
+    "rom_label": "pa-gr",
+    "rom_family": "los",
+    "rom_support": "pa-gr / LOS-based custom ROMs only",
+    "defconfig_mode": "gki_fragments",
+    "base_defconfig": "gki_defconfig",
+    "config_fragments": [
+      "vendor/waipio_GKI.config",
+      "vendor/xiaomi_GKI.config",
+      "vendor/marble_GKI.config",
+      "vendor/debugfs.config"
+    ],
+    "recommended_toolchain": "llvm-22.1.8",
+    "notes": "pa-gr SM8450 marble kernel (default branch vauxite). GKI fragments + llvm-22.1.8. Optional source_patches for Clang 22 KVM clidr (remove when upstream fixed). vauxite may ship in-tree KernelSU — smoke-test manager apply.",
+    "source_patches": {
+      "enabled": true,
+      "dir": "patches/kernel-sources/pa-gr/vauxite",
+      "match_refs": ["vauxite"],
+      "notes": "Clang 22 -Wuninitialized-const-pointer on sys_regs.c. Disable or delete when pa-gr/vauxite includes equivalent fix."
+    }
   }
 }
diff --git a/config/known-good-pins.json b/config/known-good-pins.json
index 050852c..b6c496e 100644
--- a/config/known-good-pins.json
+++ b/config/known-good-pins.json
@@ -27,9 +27,13 @@
       "repo": "Evolution-X-Devices/kernel_xiaomi_sm8450",
       "ref": "cnb"
     },
-    "pablo": {
+    "aosp-pablo": {
       "repo": "aosp-pablo/android_kernel_xiaomi_sm8450",
       "ref": "16"
+    },
+    "pa-gr": {
+      "repo": "pa-gr/android_kernel_xiaomi_sm8450",
+      "ref": "vauxite"
     }
   }
 }
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index e8f0eae..a85d12a 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -98,7 +98,7 @@ Default CI scope is **`image-only`** (kernel `Image` → AnyKernel ZIP).
                 │                            ▼
                 │              ┌──────────────────────────────────┐
                 │              │ Remote kernel source (selected)  │
-                │              │ melt | lineageos | evo-x | pablo  │
+                │              │ melt | lineageos | evo-x | aosp-pablo | pa-gr │
                 │              └──────────────────────────────────┘
                 │                            │
                 ▼                            ▼
@@ -280,7 +280,7 @@ Parallel matrix builds of different managers share the group key only when those
 | `enable_susfs` | boolean | false | Applies to KSUNext / SukiSU / ReSukiSU only |
 | `susfs_version` | choice | `v2.2.0` | `v2.2.0` · `v2.1.0` · `custom` |
 | `susfs_ref` | string | empty | Only for custom SUSFS |
-| `kernel_source` | choice | `melt` | `melt` · `lineageos` · `evolution-x` · `pablo` |
+| `kernel_source` | choice | `melt` | `melt` · `lineageos` · `evolution-x` · `aosp-pablo` · `pa-gr` |
 | `source_ref` | string | empty | Override preset branch/tag/commit |
 | `build_scope` | choice | `image-only` | `image-only` · `full` |
 | `toolchain` | choice | `android-r416183b` | Or `llvm-22.1.8` (required for LOS armv9) |
@@ -364,10 +364,35 @@ Strategy: `fail-fast: false` so one manager failure does not cancel siblings.
 | `melt` | Melt | `mohdakil2426/android_kernel_xiaomi_marble` | `melt-rebase` | `single` → `marble_defconfig` | HyperOS |
 | `lineageos` | LineageOS | `LineageOS/android_kernel_xiaomi_sm8450` | `lineage-23.2` | `gki_fragments` | LOS |
 | `evolution-x` | Evolution-X | `Evolution-X-Devices/kernel_xiaomi_sm8450` | `cnb` | `gki_fragments` | LOS |
-| `pablo` | Pablo | `aosp-pablo/android_kernel_xiaomi_sm8450` | `16` | `gki_fragments` | LOS |
+| `aosp-pablo` | aosp-pablo | `aosp-pablo/android_kernel_xiaomi_sm8450` | `16` | `gki_fragments` | LOS |
+| `pa-gr` | pa-gr | `pa-gr/android_kernel_xiaomi_sm8450` | `vauxite` | `gki_fragments` | LOS |
 
 LOS presets recommend **`llvm-22.1.8`** (armv9 march flags rejected by Android clang-12 / `clang-r416183b`).
 
+**pa-gr note:** default `vauxite` includes an in-tree `KernelSU` submodule / `drivers/kernelsu`. Out-of-tree manager apply may conflict — treat first CI runs as smoke tests.
+
+### 7.1.1 Source-local patches (optional, removable)
+
+Some presets may declare `source_patches` in `kernel-sources.json`:
+
+```json
+"source_patches": {
+  "enabled": true,
+  "dir": "patches/kernel-sources/pa-gr/vauxite",
+  "match_refs": ["vauxite"]
+}
+```
+
+| Rule | Behavior |
+|------|----------|
+| Scope | **Only** that preset + refs in `match_refs` |
+| When | After kernel checkout, **before** manager / SUSFS (`scripts/apply-kernel-source-patches.sh`) |
+| Storage | Builder repo under `patches/kernel-sources/<preset>/…` — **not** pushed to the kernel upstream |
+| Failure | `patch` reject → hard fail (forces remove/update when upstream already fixed) |
+| Other presets | No-op |
+
+**Current:** `pa-gr` @ `vauxite` — Clang 22 KVM `clidr` init. See `patches/kernel-sources/pa-gr/README.md` for removal steps.
+
 ### 7.2 Defconfig modes
 
 **`single` (Melt):**
@@ -692,7 +717,7 @@ AK3_marble_<FAMILY>_<source>_<manager>[-version][-codeN][_susfs-vX.Y.Z]_rN.zip
 
 | Token | Values |
 |-------|--------|
-| `FAMILY` | `MELT` (`melt`) · `LOS` (lineageos / evolution-x / pablo) |
+| `FAMILY` | `MELT` (`melt`) · `LOS` (lineageos / evolution-x / aosp-pablo / pa-gr) |
 | `manager` | `noroot` · `kernelsu` · `ksunext` · `sukisu` · `resukisu` |
 | SUSFS off | omit segment |
 | LTO | **not** in zip name (banner + build-info) |
@@ -848,6 +873,7 @@ Policy tests run with related env vars **unset** so ambient CI env cannot fake p
 | `validate-inputs.sh` | Bootstrap | Reject illegal manager/SUSFS/LTO/source combos |
 | `generate-build-matrix.sh` | Matrix setup | Checkboxes → JSON strategy matrix |
 | `resolve-refs.sh` | Identity | Pin manager + SUSFS to exact commits |
+| `apply-kernel-source-patches.sh` | Integrate | Optional preset/ref-gated source overlays (e.g. pa-gr) |
 | `patch-manager.sh` | Integrate | Run allowlisted manager `setup.sh` |
 | `apply-susfs.sh` | Integrate | Kernel SUSFS patch + manager Kconfig gate |
 | `build-kernel.sh` | Compile | Defconfig, LTO, make, Image validation |
diff --git a/docs/manager-matrix.md b/docs/manager-matrix.md
index 205edc2..8b2c3ad 100644
--- a/docs/manager-matrix.md
+++ b/docs/manager-matrix.md
@@ -1,6 +1,6 @@
 # Manager Matrix
 
-Last checked: 2026-07-13 (manager policy + multi-kernel presets). Kernel **source** selection is independent — see `config/kernel-sources.json` and README presets (Melt vs LOS-family).
+Last checked: 2026-07-13 (manager policy + multi-kernel presets including `pa-gr`). Kernel **source** selection is independent — see `config/kernel-sources.json` and README presets (Melt vs LOS-family: lineageos / evolution-x / aosp-pablo / pa-gr).
 
 `none` is a baseline no-root build mode. It is useful for validating the clean kernel source, build system, packaging, and AnyKernel3 flashing path. It is not a root solution, and SUSFS is blocked with `none` because SUSFS needs manager-side KernelSU-compatible hooks.
 
diff --git a/docs/verification/los-smoke-checklist.md b/docs/verification/los-smoke-checklist.md
index 8bbb85b..25e7737 100644
--- a/docs/verification/los-smoke-checklist.md
+++ b/docs/verification/los-smoke-checklist.md
@@ -46,3 +46,26 @@ notes:
 ```
 
 Do **not** claim LOS product readiness until device boot is recorded.
+
+## pa-gr smoke (optional)
+
+| Input | Value |
+|-------|--------|
+| `kernel_source` | `pa-gr` |
+| default ref | `vauxite` (`source_ref` empty) |
+| `toolchain` | `auto` → `llvm-22.1.8` |
+| `lto` | `thin` first; `full` only as experiment (free-runner OOM risk) |
+| `build_kernelsu_next` | `true` |
+| `enable_susfs` | `true` |
+| other managers | `false` |
+
+**Expect ZIP:** `AK3_marble_LOS_pa-gr_ksunext-..._susfs-v2.2.0_rN.zip`
+
+**Risk:** `vauxite` may ship in-tree KernelSU (`KernelSU` submodule / `drivers/kernelsu`) — manager apply can fail or double-apply; treat first green/fail as CI signal only.
+
+```text
+run: (paste)
+date:
+result: pass | fail
+notes:
+```
diff --git a/docs/versions.md b/docs/versions.md
index 3765120..b83c4c8 100644
--- a/docs/versions.md
+++ b/docs/versions.md
@@ -1,13 +1,14 @@
 # Verified Defaults
 
-Last updated: **2026-07-13** (branch `feature/los-kernel-source-presets` — naming, auto toolchain, CI Cache section, Wild-style manager version).
+Last updated: **2026-07-13** (branch `feature/pa-gr-kernel-source` — pa-gr SM8450 preset).
 
 | Component | Repo | Default Ref | Version / Commit |
 |---|---|---|---|
 | Kernel source (`melt`) | `mohdakil2426/android_kernel_xiaomi_marble` | `melt-rebase` | HyperOS / Melt marble source (`marble_defconfig`) |
 | Kernel source (`lineageos`) | `LineageOS/android_kernel_xiaomi_sm8450` | `lineage-23.2` | LOS GKI fragments (`gki_defconfig` + marble vendor configs) |
 | Kernel source (`evolution-x`) | `Evolution-X-Devices/kernel_xiaomi_sm8450` | `cnb` | LOS-family GKI fragments for Evolution X / custom LOS |
-| Kernel source (`pablo`) | `aosp-pablo/android_kernel_xiaomi_sm8450` | `16` | LOS-family GKI fragments (Pablo / aosp-pablo) |
+| Kernel source (`aosp-pablo`) | `aosp-pablo/android_kernel_xiaomi_sm8450` | `16` | LOS-family GKI fragments (GitHub org aosp-pablo) |
+| Kernel source (`pa-gr`) | `pa-gr/android_kernel_xiaomi_sm8450` | `vauxite` | LOS-family GKI fragments; default branch may ship in-tree KernelSU |
 | Android kernel Clang | `https://android.googlesource.com/platform/prebuilts/clang/host/linux-x86` | `master-kernel-build-2021` | commit `6e3223f76384455acde43affde3df0ea9df66c0d`; sparse path `clang-r416183b`, matching `build.config.common` |
 | LLVM experimental | `https://github.com/llvm/llvm-project/releases/download/llvmorg-22.1.8/LLVM-22.1.8-Linux-X64.tar.xz` | `llvmorg-22.1.8` | SHA-256 `df0e1ecf16caf3489a272a5eea4eec9b0d82878f6477fa309504f918a0006384`; selectable with `toolchain=llvm-22.1.8` |
 | AnyKernel3 | `osm0sis/AnyKernel3` | commit `dca9dc370838d919d56c1f59ec78b27a14a72c68` | Immutable packaging template |
@@ -23,7 +24,7 @@ Last updated: **2026-07-13** (branch `feature/los-kernel-source-presets` — nam
 
 The workflow resolves branch, tag, and commit inputs to exact commits at run time and records them in `release/build-info.txt`. For SUSFS, the user chooses `susfs_version=v2.2.0`, `susfs_version=v2.1.0`, or `susfs_version=custom`. Custom mode uses `susfs_ref` and verifies `susfs_expected_version` when provided.
 
-Device targets remain Poco F5 (`marblein`) and Redmi Note 12 Turbo (`marble`). ROM support depends on the selected kernel preset: `melt` is stock HyperOS; `lineageos`, `evolution-x`, and `pablo` are for LOS-based custom ROMs only.
+Device targets remain Poco F5 (`marblein`) and Redmi Note 12 Turbo (`marble`). ROM support depends on the selected kernel preset: `melt` is stock HyperOS; `lineageos`, `evolution-x`, `aosp-pablo`, and `pa-gr` are for LOS-based custom ROMs only.
 
 **ZIP naming (2026-07-13+):**
 
@@ -66,7 +67,7 @@ Workflow input `lto` selects Clang LTO mode for all presets (`none` / `thin` / `
 Notes:
 
 - **Melt / HyperOS** keeps LTO enabled (default `thin`) with Android `clang-r416183b`.
-- **LOS-family** presets (`lineageos`, `evolution-x`, `pablo`) should use `toolchain=llvm-22.1.8` and `lto=thin` on free runners; the workflow enables swap and caps parallelism to reduce OOM risk.
+- **LOS-family** presets (`lineageos`, `evolution-x`, `aosp-pablo`, `pa-gr`) should use `toolchain=llvm-22.1.8` and `lto=thin` on free runners; the workflow enables swap and caps parallelism to reduce OOM risk. `lto=full` is experimental on free runners (OOM risk).
 - Ccache: **4 GiB** (Android clang) / **6 GiB** (LLVM 22), content-based compiler checks, multi-level restore-keys (toolchain+LTO → kernel → source → manager).
 - ThinLTO: separate Actions cache for `~/.cache/thinlto` when `lto=thin` (similar to WildKernels LTO cache bucket).
 - **Object-cache save:** ccache / ThinLTO save on **failure as well as success** (`always() && !cancelled() && exact miss`). Partial compiles (e.g. fail at 90%) still warm the next run. ZIP/release stay success-only.
diff --git a/patches/kernel-sources/pa-gr/README.md b/patches/kernel-sources/pa-gr/README.md
new file mode 100644
index 0000000..5f8a9e8
--- /dev/null
+++ b/patches/kernel-sources/pa-gr/README.md
@@ -0,0 +1,35 @@
+# pa-gr source-local patches (ephemeral)
+
+These patches are applied **only in CI / builder workspace** after checkout of
+`pa-gr/android_kernel_xiaomi_sm8450`. They are **not** committed to the upstream
+kernel repo.
+
+## Scope
+
+| Gate | Value |
+|------|--------|
+| Preset | `KERNEL_SOURCE=pa-gr` only |
+| Branch / ref | `match_refs` in `config/kernel-sources.json` (default: `vauxite`) |
+| When | After kernel checkout, **before** manager / SUSFS apply |
+
+Other presets (`melt`, `lineageos`, …) never load this directory.
+
+## Current series (`vauxite/`)
+
+| Patch | Why |
+|-------|-----|
+| `0001-kvm-arm64-init-clidr-for-clang22.patch` | Clang 22 `-Werror,-Wuninitialized-const-pointer` on `arch/arm64/kvm/sys_regs.c` (`struct sys_reg_desc clidr` → `= {0}`). Same class of fix as stable discussions for older KVM tables. |
+
+## When to remove
+
+1. Upstream `vauxite` (or whatever `default_ref` is) already contains the init / rework, **or**
+2. Patch no longer applies cleanly (hunk reject) because the tree moved past the issue, **or**
+3. You change `default_ref` to a tree that builds with LLVM 22 without this line.
+
+Then:
+
+1. Delete the patch file and update `vauxite/series` (or remove the dir).
+2. Set `source_patches.enabled` to `false` in `config/kernel-sources.json` for `pa-gr`, or drop the block.
+3. Re-run a pa-gr smoke build.
+
+Do **not** broaden these patches to other kernel presets.
diff --git a/patches/kernel-sources/pa-gr/vauxite/0001-kvm-arm64-init-clidr-for-clang22.patch b/patches/kernel-sources/pa-gr/vauxite/0001-kvm-arm64-init-clidr-for-clang22.patch
new file mode 100644
index 0000000..8bb0b27
--- /dev/null
+++ b/patches/kernel-sources/pa-gr/vauxite/0001-kvm-arm64-init-clidr-for-clang22.patch
@@ -0,0 +1,27 @@
+From: Marble Kernel Builder <builder@local>
+Subject: [PATCH] KVM: arm64: initialize clidr for Clang 22 -Wuninitialized-const-pointer
+
+Clang 22 treats an uninitialized `struct sys_reg_desc clidr` passed to
+get_clidr_el1() as an error under -Werror (-Wuninitialized-const-pointer).
+
+get_clidr_el1() fills clidr.val; zero-init is a no-op for runtime and silences
+the diagnostic on older Android GKI trees that still use this pattern.
+
+Marble-local: pa-gr/android_kernel_xiaomi_sm8450 @ vauxite only.
+Remove when upstream includes an equivalent fix or reworks this path.
+
+---
+ arch/arm64/kvm/sys_regs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
+--- a/arch/arm64/kvm/sys_regs.c
++++ b/arch/arm64/kvm/sys_regs.c
+@@ -2750,7 +2750,7 @@ void kvm_sys_reg_table_init(void)
+ {
+ 	unsigned int i;
+-	struct sys_reg_desc clidr;
++	struct sys_reg_desc clidr = {0};
+ 
+ 	/* Make sure tables are unique and in order. */
+ 	BUG_ON(check_sysreg_table(sys_reg_descs, ARRAY_SIZE(sys_reg_descs), false));
diff --git a/patches/kernel-sources/pa-gr/vauxite/series b/patches/kernel-sources/pa-gr/vauxite/series
new file mode 100644
index 0000000..d872cfd
--- /dev/null
+++ b/patches/kernel-sources/pa-gr/vauxite/series
@@ -0,0 +1,3 @@
+# Ordered list of patches for pa-gr @ vauxite only.
+# One filename per line. Lines starting with # are ignored.
+0001-kvm-arm64-init-clidr-for-clang22.patch
diff --git a/scripts/apply-kernel-source-patches.sh b/scripts/apply-kernel-source-patches.sh
new file mode 100644
index 0000000..c69561a
--- /dev/null
+++ b/scripts/apply-kernel-source-patches.sh
@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# Apply optional source-local patches for the selected kernel preset only.
+# Patches live under patches/kernel-sources/<preset>/… and are ephemeral (CI workspace).
+set -euo pipefail
+
+KERNEL_SOURCE="${KERNEL_SOURCE:-melt}"
+SOURCE_REF="${SOURCE_REF:-}"
+KERNEL_DIR="${KERNEL_DIR:-kernel-source}"
+CONFIG_JSON="${CONFIG_JSON:-config/kernel-sources.json}"
+
+if [[ ! -f "${CONFIG_JSON}" ]]; then
+  echo "::error::Missing ${CONFIG_JSON}"
+  exit 1
+fi
+
+if [[ ! -d "${KERNEL_DIR}" ]]; then
+  echo "::error::Kernel directory not found: ${KERNEL_DIR}"
+  exit 1
+fi
+
+eval "$(
+  KERNEL_SOURCE="${KERNEL_SOURCE}" SOURCE_REF="${SOURCE_REF}" python3 - "${CONFIG_JSON}" <<'PY'
+import json
+import os
+import shlex
+import sys
+
+config_path = sys.argv[1]
+kernel_source = os.environ.get("KERNEL_SOURCE", "melt")
+source_ref = os.environ.get("SOURCE_REF", "")
+
+with open(config_path, encoding="utf-8") as fh:
+    presets = json.load(fh)
+
+if kernel_source not in presets:
+    print("APPLY=0")
+    print("REASON=unknown_preset")
+    sys.exit(0)
+
+preset = presets[kernel_source]
+sp = preset.get("source_patches") or {}
+enabled = bool(sp.get("enabled"))
+patch_dir = (sp.get("dir") or "").strip()
+match_refs = sp.get("match_refs") or []
+if isinstance(match_refs, str):
+    match_refs = [match_refs]
+
+if not enabled or not patch_dir:
+    print("APPLY=0")
+    print("REASON=disabled_or_empty")
+    sys.exit(0)
+
+if match_refs and source_ref not in match_refs:
+    print("APPLY=0")
+    print("REASON=ref_mismatch")
+    print(f"MATCH_REFS={shlex.quote(' '.join(match_refs))}")
+    print(f"SOURCE_REF={shlex.quote(source_ref)}")
+    sys.exit(0)
+
+print("APPLY=1")
+print(f"PATCH_DIR={shlex.quote(patch_dir)}")
+print(f"SOURCE_REF={shlex.quote(source_ref)}")
+PY
+)"
+
+if [[ "${APPLY:-0}" != "1" ]]; then
+  case "${REASON:-}" in
+    ref_mismatch)
+      echo "Skipping source patches for ${KERNEL_SOURCE}: SOURCE_REF='${SOURCE_REF}' not in match_refs (${MATCH_REFS:-})"
+      echo "::notice::No source-local patches applied (ref gate)."
+      ;;
+    *)
+      echo "No source-local patches configured for ${KERNEL_SOURCE} (noop)."
+      ;;
+  esac
+  exit 0
+fi
+
+if [[ ! -d "${PATCH_DIR}" ]]; then
+  echo "::error::source_patches.dir missing: ${PATCH_DIR}"
+  exit 1
+fi
+
+series_file="${PATCH_DIR}/series"
+if [[ ! -f "${series_file}" ]]; then
+  echo "::error::Missing series file: ${series_file}"
+  exit 1
+fi
+
+mapfile -t patch_names < <(
+  grep -vE '^\s*(#|$)' "${series_file}" || true
+)
+
+if [[ "${#patch_names[@]}" -eq 0 ]]; then
+  echo "series is empty under ${PATCH_DIR}; nothing to apply."
+  exit 0
+fi
+
+echo "Applying source-local patches for ${KERNEL_SOURCE} @ ${SOURCE_REF} from ${PATCH_DIR}"
+applied=0
+for name in "${patch_names[@]}"; do
+  patch_path="${PATCH_DIR}/${name}"
+  if [[ ! -f "${patch_path}" ]]; then
+    echo "::error::Patch listed in series but missing: ${patch_path}"
+    exit 1
+  fi
+  echo "  → ${name}"
+  # Fail hard on reject so a fixed upstream or drifted tree forces patch removal/update.
+  if ! patch -p1 --forward --directory="${KERNEL_DIR}" <"${patch_path}"; then
+    echo "::error::Failed to apply ${name} to ${KERNEL_DIR}."
+    echo "::error::If upstream already fixed this, remove the patch from ${PATCH_DIR}/series and disable source_patches."
+    exit 1
+  fi
+  applied=$((applied + 1))
+done
+
+echo "Applied ${applied} source-local patch(es) for ${KERNEL_SOURCE}."
+if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
+  {
+    echo "### Source-local patches"
+    echo "- preset: \`${KERNEL_SOURCE}\`"
+    echo "- ref: \`${SOURCE_REF}\`"
+    echo "- dir: \`${PATCH_DIR}\`"
+    echo "- count: ${applied}"
+  } >>"${GITHUB_STEP_SUMMARY}"
+fi
diff --git a/scripts/package-anykernel.sh b/scripts/package-anykernel.sh
index df4d013..67b8393 100644
--- a/scripts/package-anykernel.sh
+++ b/scripts/package-anykernel.sh
@@ -72,7 +72,7 @@ derive_package_family() {
   esac
 
   case "${kernel_source}" in
-    lineageos|evolution-x|pablo) echo "LOS" ;;
+    lineageos|evolution-x|aosp-pablo|pa-gr) echo "LOS" ;;
     *) echo "MELT" ;;
   esac
 }
diff --git a/scripts/resolve-kernel-source.sh b/scripts/resolve-kernel-source.sh
index 0324891..f0fa304 100644
--- a/scripts/resolve-kernel-source.sh
+++ b/scripts/resolve-kernel-source.sh
@@ -46,7 +46,7 @@ config_fragments = " ".join(fragments)
 recommended_toolchain = preset.get("recommended_toolchain") or ""
 
 rom_family_norm = (rom_family or "").lower()
-if rom_family_norm == "los" or kernel_source in ("lineageos", "evolution-x", "pablo"):
+if rom_family_norm == "los" or kernel_source in ("lineageos", "evolution-x", "aosp-pablo", "pa-gr"):
     package_family = "LOS"
 else:
     package_family = "MELT"
diff --git a/tests/test-kernel-sources.sh b/tests/test-kernel-sources.sh
index 005fbee..36210aa 100644
--- a/tests/test-kernel-sources.sh
+++ b/tests/test-kernel-sources.sh
@@ -37,7 +37,8 @@ assert_contains "${out}" "KERNEL_SOURCE_AUTHOR=Melt"
 for preset_repo in \
   "lineageos|LineageOS/android_kernel_xiaomi_sm8450|lineage-23.2|LineageOS" \
   "evolution-x|Evolution-X-Devices/kernel_xiaomi_sm8450|cnb|Evolution-X" \
-  "pablo|aosp-pablo/android_kernel_xiaomi_sm8450|16|Pablo"
+  "aosp-pablo|aosp-pablo/android_kernel_xiaomi_sm8450|16|aosp-pablo" \
+  "pa-gr|pa-gr/android_kernel_xiaomi_sm8450|vauxite|pa-gr"
 do
   IFS='|' read -r preset repo ref author <<<"${preset_repo}"
   out="$(
@@ -97,9 +98,16 @@ assert_name \
   MANAGER=none ENABLE_SUSFS=false
 
 assert_name \
-  'AK3_marble_LOS_pablo_resukisu-v4.1.0-code34990_r9.zip' \
-  KERNEL_SOURCE=pablo ROM_FAMILY=los \
+  'AK3_marble_LOS_aosp-pablo_resukisu-v4.1.0-code34990_r9.zip' \
+  KERNEL_SOURCE=aosp-pablo ROM_FAMILY=los \
   MANAGER=resukisu ENABLE_SUSFS=false \
   manager_build_version_name=v4.1.0 manager_build_version_code=34990
 
+assert_name \
+  'AK3_marble_LOS_pa-gr_ksunext-v3.2.0-code33203_susfs-v2.2.0_r9.zip' \
+  KERNEL_SOURCE=pa-gr ROM_FAMILY=los \
+  MANAGER=kernelsu-next ENABLE_SUSFS=true \
+  manager_build_version_name='v3.2.0' manager_build_version_code=33203 \
+  susfs_reported_version=v2.2.0
+
 echo "Kernel source preset tests passed"
diff --git a/tests/test-known-good-pins.sh b/tests/test-known-good-pins.sh
index 197fadc..459f25b 100644
--- a/tests/test-known-good-pins.sh
+++ b/tests/test-known-good-pins.sh
@@ -16,6 +16,11 @@ assert "managers" in data
 assert "sources" in data
 assert "melt" in data["sources"]
 assert "lineageos" in data["sources"]
+assert "pa-gr" in data["sources"]
+assert data["sources"]["pa-gr"]["repo"] == "pa-gr/android_kernel_xiaomi_sm8450"
+assert data["sources"]["pa-gr"]["ref"] == "vauxite"
+assert "aosp-pablo" in data["sources"]
+assert data["sources"]["aosp-pablo"]["repo"] == "aosp-pablo/android_kernel_xiaomi_sm8450"
 print("known-good-pins ok")
 PY
 
diff --git a/tests/test-source-patches.sh b/tests/test-source-patches.sh
new file mode 100644
index 0000000..b82740d
--- /dev/null
+++ b/tests/test-source-patches.sh
@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# Policy + dry structure tests for source-local patches (no full kernel tree required).
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${repo_root}"
+
+# pa-gr config must declare gated source_patches
+python3 - <<'PY'
+import json
+from pathlib import Path
+
+presets = json.loads(Path("config/kernel-sources.json").read_text(encoding="utf-8"))
+assert "pa-gr" in presets
+sp = presets["pa-gr"].get("source_patches") or {}
+assert sp.get("enabled") is True
+assert sp.get("dir") == "patches/kernel-sources/pa-gr/vauxite"
+assert "vauxite" in (sp.get("match_refs") or [])
+
+# Only pa-gr should have source_patches for now
+for name, preset in presets.items():
+    if name == "pa-gr":
+        continue
+    assert not preset.get("source_patches"), f"{name} must not declare source_patches yet"
+
+series = Path("patches/kernel-sources/pa-gr/vauxite/series").read_text(encoding="utf-8")
+assert "0001-kvm-arm64-init-clidr-for-clang22.patch" in series
+patch = Path("patches/kernel-sources/pa-gr/vauxite/0001-kvm-arm64-init-clidr-for-clang22.patch")
+assert patch.is_file()
+text = patch.read_text(encoding="utf-8")
+assert "struct sys_reg_desc clidr = {0}" in text
+assert "pa-gr" in text or "Clang 22" in text
+print("source patch assets ok")
+PY
+
+# Noop path for melt (no patches)
+tmp="$(mktemp -d)"
+trap 'rm -rf "${tmp}"' EXIT
+mkdir -p "${tmp}/kernel-source"
+out="$(
+  KERNEL_SOURCE=melt SOURCE_REF=melt-rebase KERNEL_DIR="${tmp}/kernel-source" \
+    bash scripts/apply-kernel-source-patches.sh
+)"
+echo "${out}" | grep -qi 'noop\|No source-local' || {
+  echo "FAIL: melt should skip source patches" >&2
+  echo "${out}" >&2
+  exit 1
+}
+
+# Ref mismatch for pa-gr
+out="$(
+  KERNEL_SOURCE=pa-gr SOURCE_REF=other-branch KERNEL_DIR="${tmp}/kernel-source" \
+    bash scripts/apply-kernel-source-patches.sh
+)"
+echo "${out}" | grep -qi 'Skipping\|ref' || {
+  echo "FAIL: pa-gr non-vauxite ref should skip" >&2
+  echo "${out}" >&2
+  exit 1
+}
+
+# Apply on a mini tree that contains the target hunk
+mkdir -p "${tmp}/ks/arch/arm64/kvm"
+cat >"${tmp}/ks/arch/arm64/kvm/sys_regs.c" <<'C'
+void kvm_sys_reg_table_init(void)
+{
+	unsigned int i;
+	struct sys_reg_desc clidr;
+
+	/* Make sure tables are unique and in order. */
+	BUG_ON(check_sysreg_table(sys_reg_descs, ARRAY_SIZE(sys_reg_descs), false));
+}
+C
+
+KERNEL_SOURCE=pa-gr SOURCE_REF=vauxite KERNEL_DIR="${tmp}/ks" \
+  bash scripts/apply-kernel-source-patches.sh >/dev/null
+
+grep -q 'struct sys_reg_desc clidr = {0};' "${tmp}/ks/arch/arm64/kvm/sys_regs.c" || {
+  echo "FAIL: patch did not initialize clidr" >&2
+  cat "${tmp}/ks/arch/arm64/kvm/sys_regs.c" >&2
+  exit 1
+}
+
+# Reject path: tree without matching hunk
+mkdir -p "${tmp}/ks2/arch/arm64/kvm"
+echo '/* empty */' >"${tmp}/ks2/arch/arm64/kvm/sys_regs.c"
+if KERNEL_SOURCE=pa-gr SOURCE_REF=vauxite KERNEL_DIR="${tmp}/ks2" \
+  bash scripts/apply-kernel-source-patches.sh >/dev/null 2>&1; then
+  echo "FAIL: mismatched tree should reject patch" >&2
+  exit 1
+fi
+
+echo "Source-local patch tests passed"
diff --git a/tests/test-workflow-policy.sh b/tests/test-workflow-policy.sh
index ad3002c..259d103 100644
--- a/tests/test-workflow-policy.sh
+++ b/tests/test-workflow-policy.sh
@@ -153,13 +153,28 @@ grep -Fq 'kernel_source:' "${matrix}" || {
   exit 1
 }
 
-for preset in melt lineageos evolution-x pablo; do
+for preset in melt lineageos evolution-x aosp-pablo pa-gr; do
   grep -Fq -- "- ${preset}" "${matrix}" || {
     echo "FAIL: matrix workflow missing kernel_source option: ${preset}" >&2
     exit 1
   }
 done
 
+grep -Fq 'apply-kernel-source-patches.sh' "${core}" || {
+  echo "FAIL: build-core does not apply optional kernel source-local patches" >&2
+  exit 1
+}
+
+[[ -f patches/kernel-sources/pa-gr/vauxite/series ]] || {
+  echo "FAIL: pa-gr vauxite patch series missing" >&2
+  exit 1
+}
+
+[[ -f scripts/apply-kernel-source-patches.sh ]] || {
+  echo "FAIL: apply-kernel-source-patches.sh missing" >&2
+  exit 1
+}
+
 grep -Fq 'kernel_source: ${{ inputs.kernel_source }}' "${matrix}" || {
   echo "FAIL: matrix workflow does not pass kernel_source to build-core" >&2
   exit 1