docs: sessiond Phase C implemented; deploy checklist

docs/session-authority-boot-order.md

@@ -2,9 +2,23 @@
 
 Companion to `SESSION-AUTHORITY-DOCTRINE.md` (§11) and
 `SESSION-TRUST-ARCHITECTURE.md`. Scope: the lock surface must exist before any
-other surface at boot, and the lock must outlive the shell process. Status:
-plan, written 2026-07-16 after the boot where an NM password dialog rendered
-before the lockscreen.
+other surface at boot, and the lock must outlive the shell process. Written
+2026-07-16 after the boot where an NM password dialog rendered before the
+lockscreen.
+
+**Status: Phase C implemented 2026-07-16** (Casey's call: skip A/B, build the
+authority). `souveraine 856c6e5` — `souveraine-sessiond` (feature `sessiond`),
+`src/sessiond/{protocol,auth,draw,lock,server}.rs`, plus the shell-side
+`SessiondBridge.qml` and the `LockScreen.initIfReady` handshake.
+`Pixel3Arch 7a85376` — pam.d service, user unit, hook start line,
+`allow_session_lock_restore`. The handoff uses the abandon+restore trick: a
+lock client that drops its connection WITHOUT unlocking leaves the compositor
+holding the session locked, and the restore flag lets the next client inherit
+it — so sessiond→shell handoff and shell-crash→sessiond retake both pass
+through zero unlocked instants. NOT yet deployed to the phone (was
+unreachable); deploy checklist below. Phases A/B remain skipped, except the
+restore flag and splash timing which Phase C absorbed (sessiond pokes
+splash-signal from its own first frame).
 
 ## What actually happens at boot today
 
@@ -135,6 +149,20 @@ gap or heartbeat proves flaky in practice.
    rich surface lives decides where that work lands — and Phase C itself
    belongs to the services-infrastructure review.
 
+## Deploy checklist (phone, when reachable)
+
+1. On-device build: `cargo build --release --features sessiond --bin
+   souveraine-sessiond` in `~/build/souveraine` (nice 15, -j 3), install to
+   `/usr/local/bin`.
+2. Sync Pixel3Arch rootfs-overlay bits: `/etc/pam.d/souveraine-sessiond`,
+   `/etc/systemd/user/souveraine-sessiond.service`; `systemctl --user
+   daemon-reload`.
+3. Deploy hyprland.lua (restore flag + hook line) and `deploy.sh --phone`
+   for the shell (bridge + LockScreen patch).
+4. Cold boot. Expected: splash → sessiond PIN surface (spartan) → shell lock
+   replaces it seamlessly once quickshell is up. `journalctl --user -u
+   souveraine-sessiond` shows acquire → handoff → locked_ack.
+
 ## Verification owed when implemented
 
 - Boot with Phase A: no surface (including NM dialog) before the lock; splash