@@ -1421,46 +1421,60 @@ jobs:
       # A bare GitHub runner has no libav* under /usr/include, so a
       # descriptor that loses its vendored headers to the host's would still
       # be green here. That is precisely how compat.ffmpeg's -idirafter hole
-      # survived: nothing in CI had a system ffmpeg to lose to. Installing
-      # the dev headers is what turns this leg into a real test of include
-      # ORDER rather than of include EXISTENCE.
+      # survived: nothing in CI had a system ffmpeg to lose to. Headers of
+      # FFmpeg's own names under /usr/include are what turn this leg into a
+      # test of include ORDER rather than of include EXISTENCE.
+      #
+      # They are planted, not installed: each public header of the release
+      # compat.ffmpeg names, as a file that stops the compile, naming itself.
+      # A reach of the host's header is then an error at the line that made
+      # it, where an installed header of another FFmpeg compiled silently or
+      # failed somewhere else. And nothing is downloaded from Ubuntu's mirror,
+      # whose ffmpeg closure (~100 MiB at the 2026-11-06 rates) outlasted
+      # every timeout on ubuntu-26.04 runners.
       #
       # Deliberately only on the llvm leg. The default leg reaches its
       # compiler through --sysroot, so it is immune by construction and
-      # installing there would change an existing job's environment for no
+      # planting there would change an existing job's environment for no
       # coverage. Keeping the blast radius to the new leg means a red here
       # is always about the thing this leg was added to watch.
-      - name: Install host ffmpeg dev headers (llvm leg only)
+      - name: Plant host ffmpeg headers that stop the compile (llvm leg only)
         if: matrix.platform == 'linux' && matrix.toolchain == 'llvm'
         shell: bash
-        # Only Ubuntu's own archive is refreshed: a bare `apt-get update` also
-        # walks every third-party source the runner image carries (PPAs,
-        # vendor repos), and one slow mirror among them held this step for
-        # minutes. Bounded timeouts and retries, and no recommended packages.
         run: |
-          apt_opts=(-o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20)
-          if [[ -f /etc/apt/sources.list.d/ubuntu.sources ]]; then
-            mkdir -p "$RUNNER_TEMP/apt-ubuntu"
-            cp /etc/apt/sources.list.d/ubuntu.sources "$RUNNER_TEMP/apt-ubuntu/"
-            apt_opts+=(-o Dir::Etc::SourceList=/dev/null -o "Dir::Etc::SourceParts=$RUNNER_TEMP/apt-ubuntu")
-          fi
-          # IPv4: on 2026-11-06 the install stalled without output for the
-          # whole timeout on several runners while the index update had taken
-          # seconds. The install now reports its progress, waits for a held
-          # dpkg lock rather than stalling on it, and is tried three times.
-          apt_opts+=(-o Acquire::ForceIPv4=true -o DPkg::Lock::Timeout=120)
-          time sudo timeout 180 apt-get update -qq "${apt_opts[@]}"
-          for attempt in 1 2 3; do
-            if time sudo timeout 240 apt-get install -y -q --no-install-recommends "${apt_opts[@]}" \
-                 libavutil-dev libavcodec-dev libavformat-dev \
-                 libavfilter-dev libavdevice-dev libswscale-dev libswresample-dev; then
-              break
-            fi
-            [[ $attempt == 3 ]] && { echo "::error::the ffmpeg dev headers did not install"; exit 1; }
-            echo "::warning::apt-get install failed (attempt $attempt); retrying"
-            sudo timeout 120 apt-get update -qq "${apt_opts[@]}" || true
-          done
-          dpkg -l | grep -E 'libav(util|codec)-dev|libswscale-dev'
+          python3 - <<'PY'
+          import hashlib, io, re, subprocess, tarfile, urllib.request
+          from pathlib import Path
+          lua = Path("pkgs/c/compat.ffmpeg.lua").read_text()
+          entry = re.search(r'linux\s*=\s*\{\s*\["([^"]+)"\]\s*=\s*\{.*?GLOBAL\s*=\s*"([^"]+)".*?CN\s*=\s*"([^"]+)".*?sha256\s*=\s*"([0-9a-f]{64})"', lua, re.S)
+          version, urls, sha = entry.group(1), (entry.group(2), entry.group(3)), entry.group(4)
+          data = None
+          for url in urls:
+              try:
+                  data = urllib.request.urlopen(url, timeout=120).read()
+              except OSError as e:
+                  print(f"::warning::{url}: {e}")
+                  continue
+              if hashlib.sha256(data).hexdigest() == sha:
+                  break
+              data = None
+          if data is None:
+              raise SystemExit(f"::error::the FFmpeg {version} source matching the descriptor could not be read")
+          libs = ("libavutil", "libavcodec", "libavformat", "libavfilter", "libavdevice", "libswscale", "libswresample")
+          planted = 0
+          with tarfile.open(fileobj=io.BytesIO(data)) as tar:
+              for name in tar.getnames():
+                  parts = name.split("/")
+                  if len(parts) == 3 and parts[1] in libs and parts[2].endswith(".h"):
+                      target = Path("/usr/include") / parts[1] / parts[2]
+                      text = f'#error "host <{parts[1]}/{parts[2]}> reached: a vendored FFmpeg header was not found first"\n'
+                      subprocess.run(["sudo", "mkdir", "-p", str(target.parent)], check=True)
+                      subprocess.run(["sudo", "tee", str(target)], input=text.encode(), check=True, stdout=subprocess.DEVNULL)
+                      planted += 1
+          if planted < 100:
+              raise SystemExit(f"::error::only {planted} FFmpeg headers were planted")
+          print(f"planted {planted} FFmpeg {version} headers under /usr/include")
+          PY
 
       # ── Select the toolchain for this leg ─────────────────────────────
       # No version pin: `llvm` resolves to whatever the toolchain family's
 
@@ -15,8 +15,10 @@
 
 ### Chore
 
-- **validate：llvm 腿安装宿主 ffmpeg 头文件时改走 IPv4、等待 dpkg 锁并重试三次。** 2026-11-06 起多个运行器上安装在超时内没有任何
-  输出，而索引更新只用数秒；安装现在输出进度，失败后重新更新索引再试。
+- **validate：llvm 腿不再从 Ubuntu 镜像安装 ffmpeg 开发包，改为在 `/usr/include` 下放置 FFmpeg 公开头文件同名、内容为
+  `#error` 的文件。** 文件名取自 compat.ffmpeg 描述符所指发布（按描述符的 sha256 校验）。宿主头文件一旦被包含即在包含处报错，
+  比安装另一版本的头文件更直接地检验包含顺序；2026-11-06 起 ubuntu-26.04 运行器上 ffmpeg 依赖闭包（约 100 MiB）的下载在每个
+  超时内都完成不了。
 
 ### Added