diff --git a/README.md b/README.md
index 8ccd31e..48bd976 100644
--- a/README.md
+++ b/README.md
@@ -43,8 +43,8 @@ source in the `PKGBUILD` (and drop the `-bin` suffix), or don't package it.
 | `cachy-auto-update` | [Felitendo/cachy-auto-update](https://github.com/Felitendo/cachy-auto-update) — unattended background updates for CachyOS (pacman, AUR, Flatpak, AppImages) | *built from source* | [cachy-auto-update](https://aur.archlinux.org/packages/cachy-auto-update) |
 | `chiaki-ng-bin` | [streetpea/chiaki-ng](https://github.com/streetpea/chiaki-ng) — PlayStation Remote Play client (Qt6) | AppImage | [chiaki-ng-bin](https://aur.archlinux.org/packages/chiaki-ng-bin) |
 | `chromium-widevine-helper` | [GloriousEggroll/chromium-widevine-helper](https://github.com/GloriousEggroll/chromium-widevine-helper) — extension + native helper installing Google's Widevine CDM into Chromium-based browser profiles | *no build step* | [chromium-widevine-helper](https://aur.archlinux.org/packages/chromium-widevine-helper) |
-| `concat` | [jub0t/Concat](https://github.com/jub0t/Concat) — free and open-source CapCut replacement (Tauri 2 shell around a Rust video engine) | *built from source* | *not published yet* |
-| `concat-bin` | [jub0t/Concat](https://github.com/jub0t/Concat) — prebuilt release of `concat` | `.deb` | *not published yet* |
+| `concat` | [jub0t/Concat](https://github.com/jub0t/Concat) — free and open-source CapCut replacement (a Slint window over a Rust video engine) | *built from source* | *not published yet* |
+| `concat-bin` | [jub0t/Concat](https://github.com/jub0t/Concat) — prebuilt release of `concat` | self-contained tarball | *not published yet* |
 | `concat-git` | [jub0t/Concat](https://github.com/jub0t/Concat) — `main` branch of `concat` | *built from source* | [concat-git](https://aur.archlinux.org/packages/concat-git) |
 | `faugus-launcher-bin` | [Faugus/faugus-launcher](https://github.com/Faugus/faugus-launcher) — launcher for Windows games via UMU-Launcher | `.deb` (`all`) | [faugus-launcher-bin](https://aur.archlinux.org/packages/faugus-launcher-bin) |
 | `fluxer-bin` | [fluxer.app](https://fluxer.app) — Fluxer desktop client (Electron) | tarball | [fluxer-bin](https://aur.archlinux.org/packages/fluxer-bin) |
diff --git a/concat-bin/.SRCINFO b/concat-bin/.SRCINFO
index 5568821..b0bb206 100644
--- a/concat-bin/.SRCINFO
+++ b/concat-bin/.SRCINFO
@@ -1,34 +1,31 @@
 pkgbase = concat-bin
-	pkgdesc = Free and open-source CapCut replacement, a Tauri video editor with a Rust engine (upstream binary)
-	pkgver = 0.2.0alpha.21
+	pkgdesc = Free and open-source CapCut replacement, a video editor with a Rust engine (upstream binary)
+	pkgver = 0.2.1
 	pkgrel = 1
 	url = https://github.com/jub0t/Concat
 	arch = x86_64
-	license = MPL-2.0
-	depends = webkit2gtk-4.1
-	depends = gtk3
-	depends = glib2
-	depends = libsoup3
-	depends = gdk-pixbuf2
-	depends = cairo
-	depends = dbus
-	depends = glib-networking
+	license = AGPL-3.0-or-later
+	license = GPL-3.0-or-later
 	depends = alsa-lib
-	depends = ffmpeg
+	depends = fontconfig
+	depends = freetype2
+	depends = libglvnd
+	depends = libxkbcommon
+	depends = libxkbcommon-x11
+	depends = libx11
+	depends = libxcursor
+	depends = libxi
+	depends = libxrender
+	depends = wayland
+	depends = dbus
 	depends = gcc-libs
 	depends = glibc
 	depends = hicolor-icon-theme
-	optdepends = whisper-cpp: on-device auto-captions and transcription
-	optdepends = vulkan-icd-loader: Vulkan compositor backend
-	optdepends = libglvnd: OpenGL compositor backend
 	provides = concat
 	conflicts = concat
-	noextract = concat-bin-0.2.0alpha.21.deb
 	options = !strip
 	options = !debug
-	source = concat-bin-0.2.0alpha.21.deb::https://github.com/jub0t/Concat/releases/download/v0.2.0-alpha.21/WolfCut_0.2.0_amd64.deb
-	source = LICENSE-0.2.0alpha.21::https://raw.githubusercontent.com/jub0t/Concat/v0.2.0-alpha.21/LICENSE
-	sha256sums = 1cc6855a2936f7c56898aa58bce69141f7349ee6728cca0f1f8c26063b5f3d3e
-	sha256sums = 0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0
+	source = concat-bin-0.2.1.tar.gz::https://github.com/jub0t/Concat/releases/download/v0.2.1/Concat-0.2.1-linux-x86_64.tar.gz
+	sha256sums = 949c30dee52ba779d5d91777510cfd57580b67467d841bd2957956219886df6f
 
 pkgname = concat-bin
diff --git a/concat-bin/PKGBUILD b/concat-bin/PKGBUILD
index 2f38dea..ee8daf3 100644
--- a/concat-bin/PKGBUILD
+++ b/concat-bin/PKGBUILD
@@ -3,72 +3,63 @@
 # https://github.com/Felitendo/PKGBUILDS
 
 pkgname=concat-bin
-pkgver=0.2.0alpha.21
+pkgver=0.2.1
 pkgrel=1
-pkgdesc="Free and open-source CapCut replacement, a Tauri video editor with a Rust engine (upstream binary)"
+pkgdesc="Free and open-source CapCut replacement, a video editor with a Rust engine (upstream binary)"
 arch=('x86_64')
 url="https://github.com/jub0t/Concat"
-license=('MPL-2.0')
-# What the binary links against, plus what it reaches for at run time:
-# glib-networking is the webview's TLS backend, and the ffmpeg pair is
-# spawned by every media operation - see the resources note in package().
-# The model downloads carry their own TLS (rustls), so openssl is not needed.
-depends=('webkit2gtk-4.1' 'gtk3' 'glib2' 'libsoup3' 'gdk-pixbuf2' 'cairo'
-         'dbus' 'glib-networking' 'alsa-lib' 'ffmpeg' 'gcc-libs' 'glibc'
-         'hicolor-icon-theme')
-# wgpu picks its backend at run time: Vulkan first, GL as the fallback. Both
-# loaders come from the driver stack every desktop already has, so neither is
-# a hard dependency of the editor.
-optdepends=('whisper-cpp: on-device auto-captions and transcription'
-            'vulkan-icd-loader: Vulkan compositor backend'
-            'libglvnd: OpenGL compositor backend')
+# The binary is Concat under the AGPL; the FFmpeg libraries it ships beside
+# itself are a BtbN GPL build. Both licence texts land in the package: the
+# repository's LICENSE, and upstream's notices file, which is what names the
+# terms of everything linked in - FFmpeg, Slint under its GPL option,
+# whisper.cpp, sherpa-onnx.
+license=('AGPL-3.0-or-later' 'GPL-3.0-or-later')
+# Nothing is spawned at run time any more: FFmpeg is linked, whisper.cpp and
+# sherpa-onnx are compiled in. What is left is what the binary loads - the
+# ALSA backend of cpal, fontconfig and freetype for text, and the windowing
+# libraries winit and the renderer open by name: EGL, Wayland, X11 and
+# xkbcommon. dbus is the XDG portal, which is how the file dialogs and
+# "reveal in file manager" work without a toolkit.
+depends=('alsa-lib' 'fontconfig' 'freetype2' 'libglvnd' 'libxkbcommon'
+         'libxkbcommon-x11' 'libx11' 'libxcursor' 'libxi' 'libxrender'
+         'wayland' 'dbus' 'gcc-libs' 'glibc' 'hicolor-icon-theme')
 provides=('concat')
 conflicts=('concat')
+# !strip: upstream's binary is already stripped, and the FFmpeg libraries
+# beside it are theirs to ship as they are.
 options=('!strip' '!debug')
-# Upstream has no stable release yet. The build workflow publishes a
-# v<version>-alpha.<n> prerelease for every green push to main, so /latest is
-# empty and the newest versioned release is picked by publication date; see
-# pkg.sh. The asset name carries tauri.conf.json's version rather than the
-# tag (every alpha of 0.2.0 ships WolfCut_0.2.0_amd64.deb), so it is resolved
-# through the GitHub API and synced here along with the checksums.
+# Upstream's Linux release is one self-contained folder: the binary, the
+# FFmpeg 8.1 runtime libraries it was linked against, a desktop entry and an
+# icon. The libraries have to come along - the binary needs libavcodec.so.62
+# and Arch is on FFmpeg 9 (libavcodec.so.63) - so the whole folder is
+# installed under /usr/lib/$pkgname, where the binary's own rpath
+# ($ORIGIN/lib) finds them.
 #
-# pkgver drops the hyphens from the tag (v0.2.0-alpha.15 -> 0.2.0alpha.15).
-# pacman sorts that older than a later plain 0.2.0 (`vercmp 0.2.0alpha.15
-# 0.2.0` is -1, the trailing alphabetic segment loses), so the prereleases
-# upgrade to the eventual stable release on their own and no epoch is needed.
-_tag="v0.2.0-alpha.21"
-_asset="WolfCut_0.2.0_amd64.deb"
-source=("${pkgname}-${pkgver}.deb::https://github.com/jub0t/Concat/releases/download/${_tag}/${_asset}"
-        "LICENSE-${pkgver}::https://raw.githubusercontent.com/jub0t/Concat/${_tag}/LICENSE")
-noextract=("${pkgname}-${pkgver}.deb")
-sha256sums=('1cc6855a2936f7c56898aa58bce69141f7349ee6728cca0f1f8c26063b5f3d3e' '0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0')
+# The asset name carries the workspace's version rather than the tag (a
+# prerelease of 0.2.2 ships Concat-0.2.2-linux-x86_64.tar.gz whatever its tag
+# says), so it is resolved through the GitHub API and synced here along with
+# the checksum; see pkg.sh.
+_tag="v0.2.1"
+_asset="Concat-0.2.1-linux-x86_64.tar.gz"
+source=("${pkgname}-${pkgver}.tar.gz::https://github.com/jub0t/Concat/releases/download/${_tag}/${_asset}")
+sha256sums=('949c30dee52ba779d5d91777510cfd57580b67467d841bd2957956219886df6f')
 
 package() {
-  # /usr/bin/wolfcut-desktop, the desktop entry, the icons and the staged
-  # resources in /usr/lib/WolfCut - the project is mid-rename, the binary and
-  # every path it installs still carry the old name.
-  bsdtar -xOf "$srcdir/${pkgname}-${pkgver}.deb" 'data.tar.*' \
-    | bsdtar -xpf - -C "$pkgdir" ./usr
+  cd "${_asset%.tar.gz}"
 
-  # Upstream stages a static ffmpeg/ffprobe pair (180 MB) and whisper-cli
-  # inside the bundle so the app runs on a machine with nothing installed.
-  # Both lookups fall back to PATH when the staged copy is missing (desktop
-  # `use_bundled_ffmpeg`, `transcribe::find_binary`), so the packaged Arch
-  # copies are used instead of shipping a second ffmpeg. Named explicitly
-  # rather than dropping the whole resource directory: anything else upstream
-  # stages there is a resource the app needs, and a rename fails here loudly.
-  rm -r "$pkgdir/usr/lib/WolfCut/ffmpeg" "$pkgdir/usr/lib/WolfCut/whisper"
-  rmdir --ignore-fail-on-non-empty "$pkgdir/usr/lib/WolfCut" "$pkgdir/usr/lib"
+  install -Dm755 concat "$pkgdir/usr/lib/$pkgname/concat"
+  # cp, not install: lib/ is the usual set of FFmpeg soname symlinks beside
+  # the real files, and only a copy that preserves them keeps it working.
+  cp -a lib "$pkgdir/usr/lib/$pkgname/lib"
 
-  # Tauri emits the entry with an empty Categories=, which keeps the editor
-  # out of the application menu. Same categories upstream's Nix build sets.
-  sed -i 's|^Categories=.*|Categories=AudioVideo;AudioVideoEditing;|' \
-    "$pkgdir/usr/share/applications/WolfCut.desktop"
+  install -d "$pkgdir/usr/bin"
+  ln -s "/usr/lib/$pkgname/concat" "$pkgdir/usr/bin/concat"
 
-  # the AUR package is named after the project, the executable after what the
-  # project used to be called - keep it reachable under both
-  ln -s wolfcut-desktop "$pkgdir/usr/bin/concat"
+  install -Dm644 concat.desktop "$pkgdir/usr/share/applications/concat.desktop"
+  install -Dm644 concat.png \
+    "$pkgdir/usr/share/icons/hicolor/256x256/apps/concat.png"
 
-  install -Dm644 "$srcdir/LICENSE-${pkgver}" \
-    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  install -Dm644 THIRD_PARTY_NOTICES.md \
+    "$pkgdir/usr/share/licenses/$pkgname/THIRD_PARTY_NOTICES.md"
 }
diff --git a/concat-bin/pkg.sh b/concat-bin/pkg.sh
index 6846696..a7bb398 100644
--- a/concat-bin/pkg.sh
+++ b/concat-bin/pkg.sh
@@ -1,35 +1,37 @@
 # concat-bin - Concat (https://github.com/jub0t/Concat), a free and
-# open-source CapCut replacement: a Tauri 2 shell around a Rust video engine.
+# open-source CapCut replacement.
 #
-# Upstream publishes a Linux .deb per release, so there is no build step
-# here: on a new version only pkgver, the asset name and the checksums are
-# refreshed and the PKGBUILD repackages the .deb.
+# Upstream publishes a self-contained Linux tarball per release, so there is
+# no build step here: on a new version only pkgver, the asset name and the
+# checksum are refreshed and the PKGBUILD repackages the tarball.
 #
-# The project has no stable release yet. Its build workflow publishes a
-# "v<version>-alpha.<n>" prerelease for every green push to main, so /latest
-# is empty and every tag is a prerelease - the alphas are what there is to
-# package. They arrive several times a day, which is also how often this
-# package can move.
+# 0.2.1 is the first release of the rewrite: the Tauri shell and its .deb are
+# gone, and the app is now one Rust binary (Slint over the engine crates)
+# shipped as Concat-<version>-linux-<arch>.tar.gz. The tag is what changed
+# least - see below.
 #
 # The release list is not ordered by version: GitHub sorts it by creation
-# time, and upstream's alpha numbering has already run out of step with it
-# (v0.2.0-alpha.10 sits between alpha.2 and alpha.1). The newest release is
-# therefore picked by publication date rather than by list position.
+# time, and upstream's alpha numbering has run out of step with it before
+# (v0.2.0-alpha.10 sat between alpha.2 and alpha.1). The newest release is
+# therefore picked by publication date rather than by list position. Only
+# tags that start with a version are considered, which is also what keeps the
+# rolling "nightly" prerelease out.
 #
-# The asset name carries tauri.conf.json's version, not the tag - every alpha
-# of 0.2.0 ships WolfCut_0.2.0_amd64.deb - so it cannot be derived from
-# pkgver and is resolved through the API into the _asset variable.
+# The asset name carries the workspace's version, not the tag - a prerelease
+# of 0.2.2 ships Concat-0.2.2-linux-x86_64.tar.gz whatever its tag says - so
+# it cannot be derived from pkgver and is resolved through the API into the
+# _asset variable.
 #
-# pkgver drops the hyphens from the tag (v0.2.0-alpha.15 -> 0.2.0alpha.15).
-# pacman sorts that older than a later plain 0.2.0 (`vercmp 0.2.0alpha.15
-# 0.2.0` is -1), so the prereleases upgrade to the eventual stable release on
-# their own and no epoch is needed.
+# pkgver drops the hyphens from the tag (v0.2.2-alpha.1 -> 0.2.2alpha.1).
+# pacman sorts that older than a later plain 0.2.2 (`vercmp 0.2.2alpha.1
+# 0.2.2` is -1), so prereleases upgrade to the eventual release on their own
+# and no epoch is needed.
 
 # Not on the AUR yet. concat-git goes up first; these two follow once the
-# alpha-per-push release cadence has been lived with for a while - upstream
-# publishes several a day, and each one is an AUR push (and, for concat, a
-# full Rust build in CI). Flip this to true to publish; until then the
-# PKGBUILD is still kept current and test-built here.
+# release cadence has been lived with for a while - upstream published
+# several alphas a day before 0.2.1, and each one is an AUR push (and, for
+# concat, a full Rust build in CI). Flip this to true to publish; until then
+# the PKGBUILD is still kept current and test-built here.
 AUR_PUBLISH=false
 
 UPSTREAM_REPO="jub0t/Concat"
@@ -52,7 +54,7 @@ latest_version() {
 # refresh_checksums <version> <pkgbuild-path>
 refresh_checksums() {
   local ver="$1" pkgbuild="$2"
-  local tag asset sha_deb sha_license
+  local tag asset sha
 
   tag="$(latest_tag)"
   if [[ "$(tag_to_pkgver <<< "$tag")" != "$ver" ]]; then
@@ -60,20 +62,23 @@ refresh_checksums() {
     return 1
   fi
 
-  # e.g. WolfCut_0.2.0_amd64.deb - the version is tauri.conf.json's, not the tag's
+  # e.g. Concat-0.2.1-linux-x86_64.tar.gz - the version is the workspace's,
+  # not the tag's
+  # `|| true`, so that a release that stops carrying the asset says so here
+  # instead of ending the run on grep's exit status with nothing printed.
   asset="$(gh api "repos/$UPSTREAM_REPO/releases/tags/$tag" --jq '.assets[].name' \
-    | grep -E '_amd64\.deb$')"
-  [[ "$(wc -l <<< "$asset")" -eq 1 ]] || { echo "expected exactly one amd64 .deb, got: $asset" >&2; return 1; }
+    | grep -E '^Concat-.*-linux-x86_64\.tar\.gz$' || true)"
+  if [[ -z "$asset" || "$(wc -l <<< "$asset")" -ne 1 ]]; then
+    echo "expected exactly one linux-x86_64 tarball in $tag, got: ${asset:-none}" >&2
+    return 1
+  fi
 
-  sha_deb="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/$tag/$asset" \
-    | sha256sum | cut -d' ' -f1)"
-  # the .deb ships no copyright file, so the license comes from the tag
-  sha_license="$(curl -sfL "https://raw.githubusercontent.com/$UPSTREAM_REPO/$tag/LICENSE" \
+  sha="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/$tag/$asset" \
     | sha256sum | cut -d' ' -f1)"
 
   sed -i \
     -e "s|^_tag=.*|_tag=\"$tag\"|" \
     -e "s|^_asset=.*|_asset=\"$asset\"|" \
-    -e "s|^sha256sums=.*|sha256sums=('$sha_deb' '$sha_license')|" \
+    -e "s|^sha256sums=.*|sha256sums=('$sha')|" \
     "$pkgbuild"
 }
diff --git a/concat-git/.SRCINFO b/concat-git/.SRCINFO
index 267953c..6dde00f 100644
--- a/concat-git/.SRCINFO
+++ b/concat-git/.SRCINFO
@@ -1,30 +1,32 @@
 pkgbase = concat-git
-	pkgdesc = Free and open-source CapCut replacement, a Tauri video editor with a Rust engine (git)
-	pkgver = 0.2.0.alpha.16.r0.g8938ec3
+	pkgdesc = Free and open-source CapCut replacement, a video editor with a Rust engine (git)
+	pkgver = 0.2.1.r12.geef4579
 	pkgrel = 1
 	url = https://github.com/jub0t/Concat
 	arch = x86_64
-	license = MPL-2.0
+	license = AGPL-3.0-or-later
 	makedepends = rust
-	makedepends = npm
+	makedepends = cmake
+	makedepends = clang
 	makedepends = pkgconf
 	makedepends = git
-	depends = webkit2gtk-4.1
-	depends = gtk3
-	depends = glib2
-	depends = libsoup3
-	depends = gdk-pixbuf2
-	depends = cairo
-	depends = dbus
-	depends = glib-networking
-	depends = alsa-lib
 	depends = ffmpeg
+	depends = alsa-lib
+	depends = fontconfig
+	depends = freetype2
+	depends = libglvnd
+	depends = vulkan-icd-loader
+	depends = libxkbcommon
+	depends = libxkbcommon-x11
+	depends = libx11
+	depends = libxcursor
+	depends = libxi
+	depends = libxrender
+	depends = wayland
+	depends = dbus
 	depends = gcc-libs
 	depends = glibc
 	depends = hicolor-icon-theme
-	optdepends = whisper-cpp: on-device auto-captions and transcription
-	optdepends = vulkan-icd-loader: Vulkan compositor backend
-	optdepends = libglvnd: OpenGL compositor backend
 	provides = concat
 	conflicts = concat
 	options = !debug
diff --git a/concat-git/PKGBUILD b/concat-git/PKGBUILD
index 2a68be8..00cfc84 100644
--- a/concat-git/PKGBUILD
+++ b/concat-git/PKGBUILD
@@ -3,34 +3,34 @@
 # https://github.com/Felitendo/PKGBUILDS
 
 pkgname=concat-git
-pkgver=0.2.0.alpha.16.r0.g8938ec3
+pkgver=0.2.1.r12.geef4579
 pkgrel=1
-pkgdesc="Free and open-source CapCut replacement, a Tauri video editor with a Rust engine (git)"
+pkgdesc="Free and open-source CapCut replacement, a video editor with a Rust engine (git)"
 arch=('x86_64')
 url="https://github.com/jub0t/Concat"
-license=('MPL-2.0')
-# glib-networking is what gives the webview a TLS backend; alsa-lib is the
-# engine's cpal playback backend; every media operation spawns the ffmpeg
-# pair - see the WOLFCUT_SYSTEM_TOOLS note below. The model downloads carry
-# their own TLS (rustls), so nothing here links openssl.
-depends=('webkit2gtk-4.1' 'gtk3' 'glib2' 'libsoup3' 'gdk-pixbuf2' 'cairo'
-         'dbus' 'glib-networking' 'alsa-lib' 'ffmpeg' 'gcc-libs' 'glibc'
-         'hicolor-icon-theme')
-makedepends=('rust' 'npm' 'pkgconf' 'git')
-# wgpu picks its backend at run time: Vulkan first, GL as the fallback. Both
-# loaders come from the driver stack every desktop already has, so neither is
-# a hard dependency of the editor.
-optdepends=('whisper-cpp: on-device auto-captions and transcription'
-            'vulkan-icd-loader: Vulkan compositor backend'
-            'libglvnd: OpenGL compositor backend')
+license=('AGPL-3.0-or-later')
+# Nothing is spawned at run time: FFmpeg is linked, whisper.cpp and
+# sherpa-onnx are compiled in. alsa-lib is cpal's playback backend;
+# fontconfig and freetype are the font side of the renderer; libglvnd and
+# vulkan-icd-loader are the two backends wgpu picks between, and the rest is
+# what winit opens by name for whichever session the user is in. dbus is the
+# XDG portal, which is how the file dialogs and "reveal in file manager"
+# work without a toolkit.
+depends=('ffmpeg' 'alsa-lib' 'fontconfig' 'freetype2' 'libglvnd'
+         'vulkan-icd-loader' 'libxkbcommon' 'libxkbcommon-x11' 'libx11'
+         'libxcursor' 'libxi' 'libxrender' 'wayland' 'dbus' 'gcc-libs'
+         'glibc' 'hicolor-icon-theme')
+# clang: bindgen (FFmpeg headers, whisper.cpp) needs libclang.
+# cmake: whisper.cpp is compiled in, by its own CMake build.
+makedepends=('rust' 'cmake' 'clang' 'pkgconf' 'git')
 provides=('concat')
 conflicts=('concat')
-# !debug: the release profile already sets strip = true, so there is nothing
-# left to split into a debug package.
+# !debug: the app profile strips symbols itself, so there is nothing left to
+# split into a debug package.
 # !lto: makepkg's lto puts -flto=auto into CFLAGS, and ring - the crypto
 # behind the model downloads' TLS - compiles hand-written assembly through
 # cc, which comes out as bitcode and links to nothing. Rust's own LTO is set
-# in the release profile and is unaffected.
+# in the app profile and is unaffected.
 options=('!debug' '!lto')
 source=("${pkgname}::git+https://github.com/jub0t/Concat.git")
 sha256sums=('SKIP')
@@ -42,73 +42,66 @@ pkgver() {
 }
 
 prepare() {
-  cd "$pkgname/desktop"
-
-  # the frontend toolchain (vite, tsc, tailwind) and the crate registry
-  npm ci --cache "$srcdir/npm-cache"
+  cd "$pkgname/engine"
 
   export RUSTUP_TOOLCHAIN=stable
-  cd src-tauri
   cargo fetch --locked --target "$(rustc -vV | sed -n 's/^host: //p')"
 }
 
 build() {
-  cd "$pkgname/desktop"
+  cd "$pkgname/engine"
 
   export RUSTUP_TOOLCHAIN=stable
   export CARGO_TARGET_DIR=target
+  # ggml (whisper.cpp's kernels) tunes itself to the machine it is compiled
+  # on unless told otherwise. A package is not always built on the machine it
+  # runs on, and a binary that faults on a CPU without AVX-512 is a bad trade
+  # for kernels nobody measured. Off, it compiles to the portable baseline.
+  export GGML_NATIVE=OFF
 
-  # build.rs refuses a release build without a staged ffmpeg/whisper-cli,
-  # because a bundle that ships without them is broken when launched from a
-  # desktop file with no PATH to fall back on. A distribution package is the
-  # documented exception: the lookups fall back to PATH, and ffmpeg and
-  # whisper-cpp are packaged for Arch already.
-  export WOLFCUT_SYSTEM_TOOLS=1
-
-  # vite build -> desktop/dist, which tauri-build embeds into the binary
-  npm run build
-
-  cd src-tauri
+  # --features wgpu: FemtoVG over wgpu instead of the default Skia renderer.
+  # skia-bindings downloads prebuilt binaries from its build script, which a
+  # package cannot do; the wgpu renderer is pure Rust. This is the same
+  # choice, for the same reason, that upstream's flake.nix makes.
+  #
+  # --profile app: upstream's shipping profile - fat LTO, panic=abort,
+  # stripped. See engine/Cargo.toml for what each knob is for.
+  #
   # sherpa-onnx-sys, the text-to-speech backend, ships no C++ build: its build
   # script downloads a prebuilt static-lib archive from its own release page.
   # concat pins that archive as a checksummed source; here the version moves
   # with main, so the build script fetches it - build() needs the network.
-  cargo build --release --frozen
+  cargo build --profile app -p concat --frozen \
+    --no-default-features --features wgpu
 }
 
 package() {
   cd "$pkgname"
 
-  # same paths the upstream .deb installs: the project is mid-rename and its
-  # executable, desktop entry and icons all still carry the old name
-  install -Dm755 "desktop/src-tauri/target/release/wolfcut-desktop" \
-    "$pkgdir/usr/bin/wolfcut-desktop"
+  install -Dm755 "engine/target/app/concat" "$pkgdir/usr/bin/concat"
 
-  # the AUR package is named after the project, the executable after what the
-  # project used to be called - keep it reachable under both
-  ln -s wolfcut-desktop "$pkgdir/usr/bin/concat"
-
-  # tauri only writes a desktop entry when it bundles, and the one it puts in
-  # the .deb has an empty Categories=. This is that entry with the categories
-  # upstream's Nix build sets.
-  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/WolfCut.desktop" <<'EOF'
+  # The desktop entry upstream's release workflow writes into the Linux
+  # tarball; there is none in the tree, because the Nix build generates its
+  # own. Reproduced here so this package and concat-bin install the same one.
+  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/concat.desktop" <<'EOF'
 [Desktop Entry]
 Type=Application
-Name=WolfCut
-Comment=Free and open source video editor
-Exec=wolfcut-desktop
-Icon=wolfcut-desktop
+Name=Concat
+Comment=Video editor
+Exec=concat
+Icon=concat
+Categories=AudioVideo;Video;
 Terminal=false
-Categories=AudioVideo;AudioVideoEditing;
-StartupWMClass=wolfcut-desktop
 EOF
 
-  install -Dm644 "desktop/src-tauri/icons/32x32.png" \
-    "$pkgdir/usr/share/icons/hicolor/32x32/apps/wolfcut-desktop.png"
-  install -Dm644 "desktop/src-tauri/icons/128x128.png" \
-    "$pkgdir/usr/share/icons/hicolor/128x128/apps/wolfcut-desktop.png"
-  install -Dm644 "desktop/src-tauri/icons/128x128@2x.png" \
-    "$pkgdir/usr/share/icons/hicolor/256x256@2/apps/wolfcut-desktop.png"
+  install -Dm644 "assets/icons/concat_logo_256.png" \
+    "$pkgdir/usr/share/icons/hicolor/256x256/apps/concat.png"
+  install -Dm644 "assets/concat_logo_512.png" \
+    "$pkgdir/usr/share/icons/hicolor/512x512/apps/concat.png"
 
   install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  install -Dm644 LICENSE-EXCEPTIONS.md \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE-EXCEPTIONS.md"
+  install -Dm644 THIRD_PARTY_NOTICES.md \
+    "$pkgdir/usr/share/licenses/$pkgname/THIRD_PARTY_NOTICES.md"
 }
diff --git a/concat-git/pkg.sh b/concat-git/pkg.sh
index 02dab20..a8577c0 100644
--- a/concat-git/pkg.sh
+++ b/concat-git/pkg.sh
@@ -1,7 +1,7 @@
 # concat-git - Concat (https://github.com/jub0t/Concat) built from the main
-# branch. Same build as concat, see that package for why the Tauri binary
-# needs nothing but a JS toolchain and cargo, and why WOLFCUT_SYSTEM_TOOLS=1
-# is the right switch for a distribution package.
+# branch. Same build as concat, see that package for why the editor needs
+# cargo, cmake and clang and nothing else, and why the FemtoVG-over-wgpu
+# renderer is the one a distribution package can build.
 #
 # The one difference: concat pins the prebuilt sherpa-onnx static-lib archive
 # as a checksummed source, which it can because the version comes from a
@@ -10,18 +10,17 @@
 #
 # VCS packages are not version-tracked here on purpose. The AUR copy of a -git
 # PKGBUILD carries only a snapshot of pkgver; the real version comes from
-# pkgver() when the user builds it. Upstream publishes an alpha release for
-# every green push to main, several times a day, so following main here would
-# mean several AUR pushes a day that change nothing for anyone.
-# latest_version() therefore reports the pkgver that is already in the
-# PKGBUILD, which makes the update run a no-op: the package is rebuilt,
-# re-checked and pushed only when the packaging itself changes.
+# pkgver() when the user builds it. Following main here would mean AUR pushes
+# that change nothing for anyone. latest_version() therefore reports the
+# pkgver that is already in the PKGBUILD, which makes the update run a no-op:
+# the package is rebuilt, re-checked and pushed only when the packaging
+# itself changes.
 #
 # When that happens, makepkg refreshes the pkgver snapshot in the PKGBUILD as
 # part of the test build, so the committed snapshot follows along by itself.
 
 # Installed in CI (pacman) before the makepkg test build.
-BUILD_DEPS=(rust npm git webkit2gtk-4.1 gtk3 libsoup3 alsa-lib)
+BUILD_DEPS=(rust cmake clang pkgconf git ffmpeg alsa-lib fontconfig freetype2)
 
 latest_version() {
   grep -Po '^pkgver=\K.*' "$(dirname "${BASH_SOURCE[0]}")/PKGBUILD"
diff --git a/concat/.SRCINFO b/concat/.SRCINFO
index 3ea2b85..8c0f697 100644
--- a/concat/.SRCINFO
+++ b/concat/.SRCINFO
@@ -1,35 +1,37 @@
 pkgbase = concat
-	pkgdesc = Free and open-source CapCut replacement, a Tauri video editor with a Rust engine
-	pkgver = 0.2.0alpha.21
+	pkgdesc = Free and open-source CapCut replacement, a video editor with a Rust engine
+	pkgver = 0.2.1
 	pkgrel = 1
 	url = https://github.com/jub0t/Concat
 	arch = x86_64
-	license = MPL-2.0
+	license = AGPL-3.0-or-later
 	makedepends = rust
-	makedepends = npm
+	makedepends = cmake
+	makedepends = clang
 	makedepends = pkgconf
-	depends = webkit2gtk-4.1
-	depends = gtk3
-	depends = glib2
-	depends = libsoup3
-	depends = gdk-pixbuf2
-	depends = cairo
-	depends = dbus
-	depends = glib-networking
-	depends = alsa-lib
 	depends = ffmpeg
+	depends = alsa-lib
+	depends = fontconfig
+	depends = freetype2
+	depends = libglvnd
+	depends = vulkan-icd-loader
+	depends = libxkbcommon
+	depends = libxkbcommon-x11
+	depends = libx11
+	depends = libxcursor
+	depends = libxi
+	depends = libxrender
+	depends = wayland
+	depends = dbus
 	depends = gcc-libs
 	depends = glibc
 	depends = hicolor-icon-theme
-	optdepends = whisper-cpp: on-device auto-captions and transcription
-	optdepends = vulkan-icd-loader: Vulkan compositor backend
-	optdepends = libglvnd: OpenGL compositor backend
-	noextract = sherpa-onnx-v1.13.6-linux-x64-static-lib.tar.bz2
+	noextract = sherpa-onnx-v1.13.7-linux-x64-static-lib.tar.bz2
 	options = !debug
 	options = !lto
-	source = concat-0.2.0alpha.21.tar.gz::https://github.com/jub0t/Concat/archive/refs/tags/v0.2.0-alpha.21.tar.gz
-	source = https://github.com/k2-fsa/sherpa-onnx/releases/download/v1.13.6/sherpa-onnx-v1.13.6-linux-x64-static-lib.tar.bz2
-	sha256sums = d90957c50750926c590dd5e26711b47f42cbac6c34246007d1cc8ca7210db3dd
-	sha256sums = fe4968c3cd2ad3dfd1ea925500e5542aef70dd7119847257ffde95d6260cd629
+	source = concat-0.2.1.tar.gz::https://github.com/jub0t/Concat/archive/refs/tags/v0.2.1.tar.gz
+	source = https://github.com/k2-fsa/sherpa-onnx/releases/download/v1.13.7/sherpa-onnx-v1.13.7-linux-x64-static-lib.tar.bz2
+	sha256sums = 3dfe1c7854b543c0bf86e239b1f02c65b14ba9b77c78ad8aa94026eeee6ebb9e
+	sha256sums = d1be7a69ac2b30120058d8302e624239a3064085383cfa47994a14fdc44c32d6
 
 pkgname = concat
diff --git a/concat/PKGBUILD b/concat/PKGBUILD
index ac4bd74..c248ff2 100644
--- a/concat/PKGBUILD
+++ b/concat/PKGBUILD
@@ -3,119 +3,108 @@
 # https://github.com/Felitendo/PKGBUILDS
 
 pkgname=concat
-pkgver=0.2.0alpha.21
+pkgver=0.2.1
 pkgrel=1
-pkgdesc="Free and open-source CapCut replacement, a Tauri video editor with a Rust engine"
+pkgdesc="Free and open-source CapCut replacement, a video editor with a Rust engine"
 arch=('x86_64')
 url="https://github.com/jub0t/Concat"
-license=('MPL-2.0')
-# glib-networking is what gives the webview a TLS backend; alsa-lib is the
-# engine's cpal playback backend; every media operation spawns the ffmpeg
-# pair - see the WOLFCUT_SYSTEM_TOOLS note below. The model downloads carry
-# their own TLS (rustls), so nothing here links openssl.
-depends=('webkit2gtk-4.1' 'gtk3' 'glib2' 'libsoup3' 'gdk-pixbuf2' 'cairo'
-         'dbus' 'glib-networking' 'alsa-lib' 'ffmpeg' 'gcc-libs' 'glibc'
-         'hicolor-icon-theme')
-makedepends=('rust' 'npm' 'pkgconf')
-# wgpu picks its backend at run time: Vulkan first, GL as the fallback. Both
-# loaders come from the driver stack every desktop already has, so neither is
-# a hard dependency of the editor.
-optdepends=('whisper-cpp: on-device auto-captions and transcription'
-            'vulkan-icd-loader: Vulkan compositor backend'
-            'libglvnd: OpenGL compositor backend')
-# !debug: the release profile already sets strip = true, so there is nothing
-# left to split into a debug package.
+license=('AGPL-3.0-or-later')
+# Nothing is spawned at run time: FFmpeg is linked, whisper.cpp and
+# sherpa-onnx are compiled in. alsa-lib is cpal's playback backend;
+# fontconfig and freetype are the font side of the renderer; libglvnd and
+# vulkan-icd-loader are the two backends wgpu picks between, and the rest is
+# what winit opens by name for whichever session the user is in. dbus is the
+# XDG portal, which is how the file dialogs and "reveal in file manager"
+# work without a toolkit.
+depends=('ffmpeg' 'alsa-lib' 'fontconfig' 'freetype2' 'libglvnd'
+         'vulkan-icd-loader' 'libxkbcommon' 'libxkbcommon-x11' 'libx11'
+         'libxcursor' 'libxi' 'libxrender' 'wayland' 'dbus' 'gcc-libs'
+         'glibc' 'hicolor-icon-theme')
+# clang: bindgen (FFmpeg headers, whisper.cpp) needs libclang.
+# cmake: whisper.cpp is compiled in, by its own CMake build.
+makedepends=('rust' 'cmake' 'clang' 'pkgconf')
+# !debug: the app profile strips symbols itself, so there is nothing left to
+# split into a debug package.
 # !lto: makepkg's lto puts -flto=auto into CFLAGS, and ring - the crypto
 # behind the model downloads' TLS - compiles hand-written assembly through
 # cc, which comes out as bitcode and links to nothing. Rust's own LTO is set
-# in the release profile and is unaffected.
+# in the app profile and is unaffected.
 options=('!debug' '!lto')
-# Upstream has no stable release yet: the build workflow publishes a
-# v<version>-alpha.<n> prerelease for every green push to main. Only the
-# versioned tags are packaged, and pkgver drops their hyphens
-# (v0.2.0-alpha.15 -> 0.2.0alpha.15), which pacman sorts older than a later
-# plain 0.2.0, so no epoch is needed. See pkg.sh.
-_tag="v0.2.0-alpha.21"
+# Only tags that start with a version are packaged, and pkgver drops their
+# hyphens (v0.2.2-alpha.1 -> 0.2.2alpha.1), which pacman sorts older than a
+# later plain 0.2.2, so no epoch is needed. See pkg.sh.
+_tag="v0.2.1"
 # sherpa-onnx-sys (the text-to-speech backend) does not build its C++ side:
 # it downloads a prebuilt static-lib archive from its own release page unless
 # it is handed one. Handing it one keeps that binary under makepkg's
 # checksums instead of arriving unverified from a build script. The version
 # follows upstream's Cargo.lock and is synced by pkg.sh.
-_sherpa="1.13.6"
+_sherpa="1.13.7"
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/jub0t/Concat/archive/refs/tags/${_tag}.tar.gz"
         "https://github.com/k2-fsa/sherpa-onnx/releases/download/v${_sherpa}/sherpa-onnx-v${_sherpa}-linux-x64-static-lib.tar.bz2")
 noextract=("sherpa-onnx-v${_sherpa}-linux-x64-static-lib.tar.bz2")
-sha256sums=('d90957c50750926c590dd5e26711b47f42cbac6c34246007d1cc8ca7210db3dd' 'fe4968c3cd2ad3dfd1ea925500e5542aef70dd7119847257ffde95d6260cd629')
+sha256sums=('3dfe1c7854b543c0bf86e239b1f02c65b14ba9b77c78ad8aa94026eeee6ebb9e' 'd1be7a69ac2b30120058d8302e624239a3064085383cfa47994a14fdc44c32d6')
 
 _srcname="Concat-${_tag#v}"
 
 prepare() {
-  cd "$_srcname/desktop"
-
-  # the frontend toolchain (vite, tsc, tailwind) and the crate registry, both
-  # fetched here so build() runs without the network
-  npm ci --cache "$srcdir/npm-cache"
+  cd "$_srcname/engine"
 
   export RUSTUP_TOOLCHAIN=stable
-  cd src-tauri
   cargo fetch --locked --target "$(rustc -vV | sed -n 's/^host: //p')"
 }
 
 build() {
-  cd "$_srcname/desktop"
+  cd "$_srcname/engine"
 
   export RUSTUP_TOOLCHAIN=stable
   export CARGO_TARGET_DIR=target
-
-  # build.rs refuses a release build without a staged ffmpeg/whisper-cli,
-  # because a bundle that ships without them is broken when launched from a
-  # desktop file with no PATH to fall back on. A distribution package is the
-  # documented exception: the lookups fall back to PATH, and ffmpeg and
-  # whisper-cpp are packaged for Arch already.
-  export WOLFCUT_SYSTEM_TOOLS=1
   # the checksummed archive from source[1], instead of a download in build()
   export SHERPA_ONNX_ARCHIVE_DIR="$srcdir"
+  # ggml (whisper.cpp's kernels) tunes itself to the machine it is compiled
+  # on unless told otherwise. A package is not always built on the machine it
+  # runs on, and a binary that faults on a CPU without AVX-512 is a bad trade
+  # for kernels nobody measured. Off, it compiles to the portable baseline.
+  export GGML_NATIVE=OFF
 
-  # vite build -> desktop/dist, which tauri-build embeds into the binary
-  npm run build
-
-  cd src-tauri
-  cargo build --release --frozen
+  # --features wgpu: FemtoVG over wgpu instead of the default Skia renderer.
+  # skia-bindings downloads prebuilt binaries from its build script, which a
+  # package cannot do; the wgpu renderer is pure Rust. This is the same
+  # choice, for the same reason, that upstream's flake.nix makes.
+  #
+  # --profile app: upstream's shipping profile - fat LTO, panic=abort,
+  # stripped. See engine/Cargo.toml for what each knob is for.
+  cargo build --profile app -p concat --frozen \
+    --no-default-features --features wgpu
 }
 
 package() {
   cd "$_srcname"
 
-  # same paths the upstream .deb installs: the project is mid-rename and its
-  # executable, desktop entry and icons all still carry the old name
-  install -Dm755 "desktop/src-tauri/target/release/wolfcut-desktop" \
-    "$pkgdir/usr/bin/wolfcut-desktop"
+  install -Dm755 "engine/target/app/concat" "$pkgdir/usr/bin/concat"
 
-  # the AUR package is named after the project, the executable after what the
-  # project used to be called - keep it reachable under both
-  ln -s wolfcut-desktop "$pkgdir/usr/bin/concat"
-
-  # tauri only writes a desktop entry when it bundles, and the one it puts in
-  # the .deb has an empty Categories=. This is that entry with the categories
-  # upstream's Nix build sets.
-  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/WolfCut.desktop" <<'EOF'
+  # The desktop entry upstream's release workflow writes into the Linux
+  # tarball; there is none in the tree, because the Nix build generates its
+  # own. Reproduced here so this package and concat-bin install the same one.
+  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/concat.desktop" <<'EOF'
 [Desktop Entry]
 Type=Application
-Name=WolfCut
-Comment=Free and open source video editor
-Exec=wolfcut-desktop
-Icon=wolfcut-desktop
+Name=Concat
+Comment=Video editor
+Exec=concat
+Icon=concat
+Categories=AudioVideo;Video;
 Terminal=false
-Categories=AudioVideo;AudioVideoEditing;
-StartupWMClass=wolfcut-desktop
 EOF
 
-  install -Dm644 "desktop/src-tauri/icons/32x32.png" \
-    "$pkgdir/usr/share/icons/hicolor/32x32/apps/wolfcut-desktop.png"
-  install -Dm644 "desktop/src-tauri/icons/128x128.png" \
-    "$pkgdir/usr/share/icons/hicolor/128x128/apps/wolfcut-desktop.png"
-  install -Dm644 "desktop/src-tauri/icons/128x128@2x.png" \
-    "$pkgdir/usr/share/icons/hicolor/256x256@2/apps/wolfcut-desktop.png"
+  install -Dm644 "assets/icons/concat_logo_256.png" \
+    "$pkgdir/usr/share/icons/hicolor/256x256/apps/concat.png"
+  install -Dm644 "assets/concat_logo_512.png" \
+    "$pkgdir/usr/share/icons/hicolor/512x512/apps/concat.png"
 
   install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  install -Dm644 LICENSE-EXCEPTIONS.md \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE-EXCEPTIONS.md"
+  install -Dm644 THIRD_PARTY_NOTICES.md \
+    "$pkgdir/usr/share/licenses/$pkgname/THIRD_PARTY_NOTICES.md"
 }
diff --git a/concat/pkg.sh b/concat/pkg.sh
index 4749c91..cbc7626 100644
--- a/concat/pkg.sh
+++ b/concat/pkg.sh
@@ -1,12 +1,12 @@
 # concat - Concat (https://github.com/jub0t/Concat), a free and open-source
-# CapCut replacement: a Tauri 2 shell around a Rust video engine.
+# CapCut replacement.
 #
-# Source package: the PKGBUILD builds the Tauri binary from the release
-# tarball - the same executable upstream wraps into the .deb that concat-bin
+# Source package: the PKGBUILD builds the editor from the release tarball -
+# the same binary upstream ships in the Linux tarball that concat-bin
 # repackages. Upstream's flake.nix is the reference for what that needs, and
-# this follows it: JS toolchain plus cargo, and WOLFCUT_SYSTEM_TOOLS=1 to opt
-# out of staging a private ffmpeg/whisper-cli into the bundle, because Arch
-# packages both and the app falls back to PATH.
+# this follows it: cargo, cmake and clang, the system FFmpeg, and Slint's
+# FemtoVG-over-wgpu renderer instead of the default Skia one, because
+# skia-bindings downloads its binaries from the build script.
 #
 # sherpa-onnx-sys, the text-to-speech backend, ships no C++ build: its build
 # script downloads a prebuilt static-lib archive from the sherpa-onnx release
@@ -16,23 +16,22 @@
 # upstream's Cargo.lock, so refresh_checksums() reads it from the tarball and
 # syncs the _sherpa variable in the PKGBUILD.
 #
-# Release/version handling is identical to concat-bin: every upstream release
-# is a "v<version>-alpha.<n>" prerelease published on a push to main, the
-# release list is ordered by creation rather than by version (v0.2.0-alpha.10
-# sits between alpha.2 and alpha.1), so the newest is picked by publication
-# date, and pkgver drops the hyphens - see concat-bin/pkg.sh.
+# Release/version handling is identical to concat-bin: the release list is
+# ordered by creation rather than by version, so the newest is picked by
+# publication date, only tags that start with a version count, and pkgver
+# drops the hyphens - see concat-bin/pkg.sh.
 
 # Not on the AUR yet. concat-git goes up first; these two follow once the
-# alpha-per-push release cadence has been lived with for a while - upstream
-# publishes several a day, and each one is an AUR push (and, for concat, a
-# full Rust build in CI). Flip this to true to publish; until then the
-# PKGBUILD is still kept current and test-built here.
+# release cadence has been lived with for a while - upstream published
+# several alphas a day before 0.2.1, and each one is an AUR push (and, for
+# concat, a full Rust build in CI). Flip this to true to publish; until then
+# the PKGBUILD is still kept current and test-built here.
 AUR_PUBLISH=false
 
 UPSTREAM_REPO="jub0t/Concat"
 
 # Installed in CI (pacman) before the makepkg test build.
-BUILD_DEPS=(rust npm webkit2gtk-4.1 gtk3 libsoup3 alsa-lib)
+BUILD_DEPS=(rust cmake clang pkgconf ffmpeg alsa-lib fontconfig freetype2)
 
 latest_tag() {
   gh api "repos/$UPSTREAM_REPO/releases?per_page=100" \
@@ -70,8 +69,12 @@ refresh_checksums() {
   fi
 
   sha_src="$(sha256sum "$tarball" | cut -d' ' -f1)"
-  sherpa="$(tar -xOzf "$tarball" --wildcards '*/desktop/src-tauri/Cargo.lock' \
-    | grep -A2 '^name = "sherpa-onnx-sys"' | sed -n 's/^version = "\(.*\)"/\1/p')"
+  # `|| true`, so that a tree that has moved the lockfile or dropped the crate
+  # is reported below instead of ending the run on grep's exit status with
+  # nothing printed.
+  sherpa="$(tar -xOzf "$tarball" --wildcards '*/engine/Cargo.lock' \
+    | grep -A2 '^name = "sherpa-onnx-sys"' | sed -n 's/^version = "\(.*\)"/\1/p' \
+    || true)"
   rm -f "$tarball"
 
   if [[ -z "$sherpa" ]]; then
diff --git a/fluxer-bin/pkg.sh b/fluxer-bin/pkg.sh
index b523465..54c5695 100644
--- a/fluxer-bin/pkg.sh
+++ b/fluxer-bin/pkg.sh
@@ -3,14 +3,38 @@
 # Upstream hosts versioned prebuilt binaries itself, so there is no
 # build_artifact() here: on a new version only pkgver and the checksums
 # are refreshed and the result is pushed to the AUR.
+#
+# The download API has one URL shape per channel, and this package follows
+# "stable". Its /latest currently 302s into the canary channel - upstream has
+# published nothing to stable since 0.0.8, and the pointer falls through to
+# the channel that is moving. A canary build is a nightly, not what a package
+# called fluxer-bin ships, so latest_version() recognises the fall-through
+# and reports EX_TEMPFAIL instead of a version; see below.
 
 DL_BASE="https://api.fluxer.app/dl/desktop/stable/linux"
 
 latest_version() {
+  local name ver
+
   # the download API exposes the current version in the attachment filename,
   # e.g. content-disposition: attachment; filename="fluxer-stable-0.0.8-x64.tar.gz"
-  curl -sfI "$DL_BASE/x64/latest/tar_gz" \
-    | grep -oiP 'filename="fluxer-(stable-)?\K[0-9][^"]*(?=-x64\.tar\.gz)'
+  #
+  # -L, and the last filename of the chain: when the stable channel has no
+  # current build the request is redirected to another channel, and the
+  # filename it answers with is how that becomes visible here.
+  name="$(curl -sfIL "$DL_BASE/x64/latest/tar_gz" \
+    | grep -oiP 'filename="\K[^"]+' | tail -n1)"
+
+  ver="$(grep -oiP '^fluxer-(stable-)?\K[0-9][^"]*(?=-x64\.tar\.gz$)' <<< "$name" \
+    || true)"
+  if [[ -z "$ver" ]]; then
+    # e.g. Fluxer-Canary-2026.904.135113-linux-x64.tar.gz - the canary channel
+    echo "the stable channel's latest download is \"$name\", which is not a" \
+         "stable build - nothing to update to" >&2
+    return 75
+  fi
+
+  printf '%s\n' "$ver"
 }
 
 # refresh_checksums <version> <pkgbuild-path>
diff --git a/scripts/update-package.sh b/scripts/update-package.sh
index d1e4629..959bd3d 100644
--- a/scripts/update-package.sh
+++ b/scripts/update-package.sh
@@ -34,7 +34,18 @@ BUILD_DEPS=()
 AUR_PUBLISH=true
 source "$pkg/pkg.sh"
 
-ver="$(latest_version || true)"
+# A package whose upstream release channel is temporarily out of order - a
+# "latest" pointer that has stopped pointing at a release - can return 75
+# (EX_TEMPFAIL) from latest_version instead of printing one. There is nothing
+# to update while that lasts and nothing wrong with the package, so the run
+# warns and stops rather than going red, and the next one picks it up.
+rc=0
+ver="$(latest_version)" || rc=$?
+if [[ "$rc" -eq 75 ]]; then
+  echo "::warning::$pkg: upstream has no current release to track right now -" \
+       "leaving the package as it is, the next run tries again."
+  exit 0
+fi
 if [[ -z "$ver" || "$ver" == "null" ]]; then
   echo "::error::$pkg: could not determine the latest upstream version"
   exit 1