docs: session handoff 2026-07-16 - idle/lock landing, chatty stack state

docs/session-handoff-2026-07-16.md

@@ -0,0 +1,96 @@
+# Session handoff — 2026-07-16 (idle/lock/session + Chatty stack)
+
+Casey (he/him). Souveraine = OS + agent substrate + agent. Ani + Aster = Annie.
+
+## Landed this session
+
+**libcmatrix (`~/Projects/libcmatrix`, branch `sas-fixes`) — the whole library
+half of the Chatty features stack, 8/8 tests pass:**
+
+- `a337819` edits — `CmEventRelation` type, `m.replace` + `m.new_content`,
+  `cm_room_send_edit_async`. In encrypted rooms the relation rides the
+  cleartext envelope for server aggregation; `m.new_content` stays encrypted.
+- `a671822` redactions — `cm_room_redact_event_async`, direct PUT, optional
+  reason.
+- `8bde46c` replies — inbound parse finally populates `reply_to_event_id`
+  (field existed for years, nothing wrote it); `cm_room_send_reply_async`.
+- `aafcac4` reactions — inbound target+key getters
+  (`cm_event_get_reacts_to_id` / `get_reaction_key`); outbound
+  `CmReactionEvent` rides the existing message queue so encrypted rooms get
+  normal key handling. Queue no longer assumes message events.
+
+**Touch-after-idle regression — root-caused and fixed** (`Pixel3Arch
+73d0cd0`): hypridle still issued raw `hyprctl dpms` after
+`blueline-screen-toggle` became the serializing DPMS authority. A double-tap
+wake is also input activity, so `on-resume` raced the XF86WakeUp wake and the
+FTS controller calibrated against a half-ramped panel (dmesg: "MS invalid Self
+Strength soft Force cal") — touch went deaf/erratic after idle. Both paths now
+serialize through the toggle. Rebinding the driver
+(`echo 2-0049 > /sys/bus/i2c/drivers/fts/unbind` then `bind`) recovers a
+wedged controller without reboot.
+
+**Idle manager, first real pass** (`souveraine b18fa33`, deployed to phone):
+
+- Dim now exists: `IdleCoordinator` Dimmed runs `brightnessctl -s set <dimBrightness>`,
+  Active restores with `-r`. Previously `dimRequested` had NO consumer —
+  auto-dim never existed on this stack (Android's PowerManager dim stage had
+  no equivalent driver here).
+- Native coordinator ENABLED on the phone (`nativeCoordinatorEnabled: true`
+  live; repo default still false), dim 120s / lock 300s.
+- **Hard-won lesson:** binding `IdleMonitor.enabled` to `Idle.inhibit`
+  destroys/recreates the ext-idle-notify object during lock teardown (ii's
+  LockScreen toggles the inhibit) → fatal Wayland "invalid object" protocol
+  error → whole shell dies. Inhibit must be checked INSIDE the idle handlers;
+  monitor objects must stay alive for the shell's lifetime.
+- hypridle keeps its 300s lock listener as a redundant fallback until the
+  native path has soaked; double-lock is a no-op. dpms-off (600s) and suspend
+  (900s) remain hypridle's.
+
+**Power button = lock-then-blank** (`Pixel3Arch 7d1581c`, deployed):
+`XF86PowerOff` → `blueline-power-button`: screen on → `session lock` IPC →
+wait ≤2s for compositor-acked `"locked": true` → blank via the DPMS
+authority. Screen off → wake (to lockscreen). Tap-to-wake unchanged.
+
+## In flight / not yet landed
+
+- **Chatty UI for edits/redact/reply/react** — subagent repeatedly killed by
+  Anthropic 529 overload; repo `~/Projects/Chatty` branch `identity-layer`.
+  Check `git log` there before assuming anything landed.
+- **qtpim sqlite contacts engine** — same 529 story; target
+  `~/Projects/qtcontacts-souveraine` (path 3 per `contacts-design.md`).
+- **souveraine-secrets on the phone** — building on-device at
+  `~/build/souveraine` (log `/tmp/secrets-build.log`); laptop has no aarch64
+  sysroot (cross-rig is on the other machine — provisioning gap). Two
+  blockers after the build: (1) phone has NO `~/.souveraine/seed-id` — only
+  `seed-id.pre-split-20260716` backup; daemon refuses to start seedless by
+  design; restore-vs-regenerate is Casey's call, depends on what the seed
+  split intended. (2) gnome-keyring currently owns `org.freedesktop.secrets`
+  on the phone; mask it at switchover (homogenization doctrine anyway).
+
+## Casey's named next wants (queue for coming sessions)
+
+1. **Favorites** — the original motivator. Blocked on contacts store →
+   Person layer; Chatty identity-layer steps 1–3 already exist.
+2. **Lockscreen recreation** — PIN pad is currently always present; wanted:
+   swipe-to-unlock gesture with PIN behind it, lockscreen widgets. Existing
+   design notes in the session-trust / lock docs.
+3. **Idle manager intelligence** — proximity/pocket detection ("obstructed"
+   sensor state) gating whether the screen should ignore or accept input;
+   settings-dependent idle profiles (charging/docked/media). Relates to the
+   already-documented proximity-wake-bypasses-lock issue in
+   `DUMP-power-idle-lock-2026-07-15.md` §2 — same sensor, same doctrine:
+   proximity may wake the display but must never touch lock state.
+4. **Session-authority layer** ("souveraine user") — lockscreen owned below
+   the user shell so a shell crash can't take the lock surface with it; the
+   power-button choreography above is the interim. Design sitting, main
+   conversation (Aster-adjacent boundary).
+
+## Verification still owed
+
+- Native idle path soak on phone post-reboot: dim at 2min (backlight drops,
+  restores on touch), lock at 5min, unlock does NOT kill the shell (the
+  fixed IdleCoordinator was deployed but the full cycle wasn't re-verified
+  after the protocol-error fix).
+- Power button end-to-end after reboot (binding loads with new hyprland.lua).
+- Reboot must be a COLD boot (unplug, power off) — warm reboots poison
+  TZ/remoteproc state on blueline.