August 9, 2026

Display pipe binds and the panel stays dark; touch worked once and stopped. Both have a named single-boot test rather than a theory. Driver changes and rails are ruled out by test; the display path is not.

blueline-screen-toggle does not exist here so the blank no-ops, and Dim is an absolute that reads as off on a 2047-step backlight. Lit-forever or black-forever, nothing between, until eb0292c ships.

One row per capability, one column per body, with a strict status vocabulary — "works" means exercised with evidence named, never that a device node appeared. blueline points at PAF/ rather than copying it; d10 carries its own state; m1 records what already transfers before anything is measured.

Touch proven with real events, not a device node: three layers, the last being runtime report activation gated to D11 so D10 went silent a second after boot.

The shell is on the iPhone 7 — viewtop, sessiond and qs, drawn by llvmpipe on a card with no render node, over one cable. Wallpaper, palette, bar, clock, dock and her quote match the Pixel.

STATE moved to 2026-08-09. One instrument is waiting on a finger; everything else about the enrol lifecycle is reachable in RAM today.

fprintd, gazed, sailfish-fpd and biometryd are the same interface four times. Take that shape and face and finger become one surface with two backends. Mapped every call onto the recovered TA commands; the gaps are persistence and the auth token, both already named.

Prior art checked: sailfish-fpd-community needs hybris, wrobelda's libfprint branch is the only match-on-chip-over-QSEE example, and nobody has done FPC over QSEE natively. One listener receiver per device means the supplicant is a separate owner from the fp daemon.

The remaining citations in package recipes, overlay patches and task files still named the retired in-repo spine.

pkgrel 6. Adds a stream mode that holds both endpoint fds open and acknowledges each accepted report, so the shell-side controller is a persistent trackpad and keyboard rather than a process per keystroke.

SouveraineOS 72aaa53 copied the spine on 2026-07-24 and this repo kept a live copy, so both drifted through phone calls, Active Edge and the fingerprint work. The newer tree was promoted before this duplicate was retired; nothing was lost, and 9b1afd1 still holds the whole retired PAF.

fp-arm/bringup/go/load/sweep have been in ~ on the device since 2026-08-01; a reprovision would have taken them. fp-go's error table, decoded from the HAL, independently matches the router codes read out of the TA today -- recorded in the protocol doc.

Target 10 command 1 is check_finger_lost. Arms exactly once and brackets every query with the interrupt count, so the call's own edge is reported apart from spontaneous ones -- the 1444-event trap.

The only persistence is qsee_fts_*, reached from three wrappers. Call graph says targets 2 and 12 reach them and nothing else does, so the enrol/identify lifecycle runs in RAM with no listener. Parking TZ is the real hazard and it lives in target 2 alone.

The TA is not stripped: every handler logs __func__, so the router's jump tables resolve to names. Eight targets; sensor is 10 and bio is 11 with the full enrol/identify/enumerate/delete set. Target 10 command 1 is check_finger_lost, which is the instrument TASK-44 was missing. Static, from the vendor image on disk.

qcom_qseecom is bound on the phone, so QSEE is reachable from mainline today and the TEE slot is simply empty. linux-firmware carries no fingerprint TA on sdm845/sm8250/sm8150, so TAs are per-device extracts, not shippable. Blind qfprom dumps stay off the daily driver.

fpctzappfingerprint was in blueline's own vendor.img, and it is FPC's cross-OEM name, not a per-device one. Google's driver and the b1c1 fingerprint dtsi pulled down beside it. qtestsign's own README settles persistent EL2: test keys need secure boot off, and XBL authenticates hyp before ABL can know the bootloader is unlocked.

PersistentProperties is in-process, so it carries the surface choice through a reload and not through a fresh shell. sessiond locks before the shell exists, so a greetd-started shell adopts a live lock with Config.ready still false and binds the desktop surface — and WlSessionLock.surfaceComponent cannot change once active. A lock screen that will not take your PIN, on the iPhone 7 tonight.

brightnessctl set 10 is 4% on blueline's 255-step backlight and 0.5% on the iPhone 7's 2047-step Apple DWI, where it reads as fully off. Measured on d10 2026-08-09: brightness=1 with the panel still powered, so the screen went black on a dim that never blanked.

Power is the one irreversible transition and it bypassed the authority entirely: both menus called Session.poweroff() straight into systemctl, so there was no Action, no trail entry and no refusal path.

CI already built the x86_64 daemon and then threw it away — the binary and its user unit were copied into the package only under aarch64, so the laptop could never receive the thing every lock, blank and button report assumes is running.

78d6743 committed PowerMenu's half and never added the file, so the singleton in qmldir resolved to nothing and the shell would not load on a tree that had not been hand-linked.

Points at the personal agreement and the cross-repo map, names this tree as the substrate rather than a harness, and starts architecture at saf/INDEX.md.