July 28, 2026

lockprobe replays the boot handoff against a running viewtop without involving sessiond, so the server side is provable on a daily driver with no risk of locking it. Result:

- kms.rs: libseat + udev + DrmDevice + GBM + GlesRenderer + connector scan, vblank as the frame clock. Single GPU, single panel, no hotplug or leasing — blueline has one soldered DSI panel and the rest is a laptop problem. Compiles and cross-compiles; not yet executed, since running it takes the panel from the live session. First run is the boot test. - viewtop takes --nested or --kms, sharing socket setup and the dispatch loop. - spawn_heartbeat: registers as the live shell and streams directives. Proven on blueline — sessiond answered `refused_by_state — shell authority is already registe...

viewtop now starts, serves a Wayland socket, and reads the live daemon. On blueline it came up with sessiond's real state: locked, display_active false, dimmed true.

- layers.rs: furniture stacking is a derived total order, not a z-index anyone configures. pill_outranks_dock is a test. INTERFACE-ARCHITECTURE's recurring defect is a documented guarantee the code doesn't enforce, and the pill one was a Lua layerrule in another repo. State gates visibility (Phosh model): locked drops the dock, overview and dial, keeps the pill. - navigation.rs: TASK-37. can_go_back is the state channel; the verb alone is the losing design. Two declared tiers — tier 2 gets XF86Back synthesised and BackOutcome::Synthesised carries no success flag, so tier 2 can't be reported...

Read souveraine/src/sessiond/{lock,server}.rs and TASK-02/03/41 — the previous commit's lock model was wrong about the common case.

- lock.rs: serves the protocol; sessiond keeps the decision, viewtop attests presentation. disclosure_locked() is the union of both answers, fail-closed. Abandoned locks are adoptable by the same uid so a sessiond restart while locked isn't unrecoverable — no unlocked frame across the handover. - gate.rs: replaces denial's secure_session_locked(). Splits routing / disclosure / composition. Composition is never gated by lock; unlock is never an agent verb, unconditionally. - Sensitivity is its own axis, off SurfaceKind — a toplevel can hold personal content. Defaults to Personal. - shell-hos...

SessionFacts carried {locked, lock_secure, read_grant} — a shape of our own invention that the daemon never sends. It now matches the device_state reply field for field, so it deserializes straight off the wire and a rename here is a protocol change rather than a refactor: device_state, display_active, dimmed, observed, observed_confidence, sensors_degraded.

Ambient, personal, step-up. Grants are bound to an action family, expire on a policy window, and clear on lock. Cannot be minted from a boolean.

Compositor sends facts, shell sends intents. The shell is one of several things that can ask and none of them is the authority.

sessiond-client is tested against the live daemon. No compiled-in verb vocabulary: describe returns the table and callers plan from it. Nothing caches state the protocol owns.

CONFIG_CC_VERSION_TEXT and friends are stamped by kbuild from whatever toolchain is installed, not chosen. [host] went 22.1.6 -> 22.1.8 and the drift guard rejected every build. Filter the auto-derived version symbols out of the comparison; a real option appearing or disappearing still fails.

Camera, fingerprint and haptics now point at their SouveraineOS task files and record the substrate that already exists for each.

Force is detected without the nanoapp; the gpio-hog changed when the rail comes up relative to SSC enumerating the ADC, not what voltage it sits at. Records the calibration, the threshold model from Google's sweep, the sessiond gating, and the five gaps — doze being the real one.

The producer called the shell directly: no idle reset, no forensic trail, no pocket veto, no source health. DEVICE-STATE-MACHINE 12 calls that an eighth blind actor. It now asks sessiond (input, trigger squeeze) and delivers only if admitted, failing closed when the authority is unreachable.

chrecd runs as root; the gesture consumer is in the user session. blueline-chre-gesture is that crossing and decides nothing — same contract blueline-edge-sense already delivers (ipc call gesture squeeze). Verified live: 'squeeze -> dial' in the shell log.

pkgrel 8 emitted a 76-byte NanoappMessage; app_id landed 4 mod 8 and CHRE's verifier rejected every one (recognizer start failed: -1, then the SLPI took sensors down). The encoder never padded the buffer to its own max alignment. Verified against flatc + VerifyMessageContainerBuffer on the laptop, 18 cases.

13 (grip) and 35 (sessiond deadlock) are done; both moved to archive/ with closing notes. Index regrouped by state with a one-line what's-left per task instead of a flat table of history; the archive prose moved to archive/README.

A rotted action pin skipped the publish job rather than failing it, so edge stopped publishing and the phone sat on an old build for a working day with nothing saying why. The runner journal logs task pickup and never outcome, which is what was being read.

Foundation landed: lock handoff, admission gate, layer stack, back verb, intent table. 123 tests, CI green for the first time (repo was never fmt-clean). No Wayland/DRM yet.

TASK-39 step 1 is done and clean — default-routes stores 0.49 cubed and rewrites within 6s of a change. 'Pinned on boot' is a faithful restore of a value lower than wanted, so this is defaults and roles. No second writer.

07-27's 'ignores force' conclusion is superseded — same binary, no nanoapp, 2502-2990 deflection. Kept verbatim below the correction. The nanoapp is off grip's critical path but still wanted for doze, the real detector, haptics and TASK-40.

Our engine pins are already theirs. The embedder, the eleven-patch DMSAA/external-texture series, KMS and the GBM atlas path are the expensive parts and they are readable.

29eef336 was the tip of dtolnay's stable branch when pinned. That branch force-moves each Rust release, orphaning the commit — reachable from no ref, so act resolves 'reference not found' and rust-test dies before compiling. That skipped aarch64-artifact and stopped edge publishing with nothing saying why. master is append-only.

Active Edge becomes InputTrigger::Squeeze. It resets the idle budget and lands in the trail like any real input, but unlike a power button it is a sensor reading and a tight pocket is a squeezed chassis, so it carries the same proximity veto as tap-to-wake (DEVICE-STATE-MACHINE 4).

Stdlib-only daemons on [host], API-compatible with the VibeVoice and faster-whisper services they replace on .19. Includes systemd units and voice-identity measurement tools.

Golden bytes verified against flatc-generated readers and VerifyMessageContainerBuffer; harness kept in tests/ but not wired into meson since it needs flatc.

A loaded nanoapp is not a running one. elmyra stays silent until a host client sends RECOGNIZER_START (200), which is why a squeeze produced nothing after a load that reported success=true.

The front pair has been declared since the camera series landed; the rear sensor never was, so CSIPHY0 and CCI master 0 sat unused with the driver built and enabled.