55: sheet, split chooser, power menu; viewtop ships by pacman

START-HERE.md

@@ -144,7 +144,7 @@ update.**
 | `souveraine`, sessiond, machined, secrets | **pacman**, built by CI on push to `primary` | Needs the VPN up — the repo is at `10.10.20.120:4455` |
 | Device packages (`pkgs/*`) | **pacman**, from Pixel3Arch CI | `pkgs/**` has no workflow for some paths — check |
 | `rootfs-overlay/` | **flash only** | **This phone does not flash.** An overlay-only fix never arrives. This is TASK-28, and it is what broke USB for months. |
-| viewtop | hand-copied to `/usr/local/bin` | Not packaged yet — TASK-25. |
+| viewtop | **pacman**, built by CI on push to `main` | Packaged since TASK-25 closed. `/usr/bin/viewtop` is owned by `souveraine-viewtop`; verify with `pacman -Qo /usr/bin/viewtop`, whose version carries the commit. **Do not hand-copy over it** — that is the "silently never updates" trap this table exists for. Installing does not restart it; the running compositor keeps the old binary until the session restarts. |
 | QML shell | per-file `scp` | **Never `deploy.sh --phone`.** Check whether the live path is a symlink into `ii/` or a real override; patch every copy. |
 
 **A green CI run on `primary` can ship nothing and look identical to one that

docs/tasks/14-overview-appgrid.md

@@ -4,6 +4,33 @@
 actually useful on a phone, appgrid-shaped; expanded 2026-07-21 to include
 Auxo-like running-app cards and an unconditional Home path.
 
+**Progress 2026-08-05:** home/multitasking split landed in the shell
+(`surfaces/quickshell/modules/ii/overview/`). AppGrid.qml is new (paged,
+alphabetical, 4x5 per page, page dots, slide-up entry) and renders when
+`overviewOpen`; the running-cards surface (`WindowOverview`) now renders ONLY
+for `missionControlOpen` (pill stage-2 swipe). The two states are mutually
+exclusive — opening one closes the other. Search stays above the grid; mission
+control takes no search and no OSK. Untested on glass (laptop or phone).
+
+**Finesse pass (same day, deployed to phone 09:41, reload clean):** the OSK
+no longer auto-raises with the drawer — it is summoned by tapping the search
+pane (`oskSummoner` MouseArea in Overview.qml; the field is re-focused before
+the keyboard opens so keystrokes land). The drawer got a translucent theme
+sheet (`panelBg`, `transparentize(colLayer1, 0.12)`, radius/border, wraps the
+column; the window mask now follows panelBg — a real GaussianBlur needs
+Qt5Compat and dies on the phone's GLES backend). The dock hides while the
+drawer is open via `dockSuppressed` (not `dockRevealed`: a pinned dock ignores
+dockRevealed — Dock.qml only lets dockSuppressed beat effectivePinned), and is
+restored on close. Both bodies fill 0.78 of the panel instead of 0.7. Grid is
+configurable: `Config.options.overview.appGrid {columns, rows, iconSize}` (new
+nested block — the legacy overview rows/columns are the desktop workspace-grid
+knobs and were left untouched), surfaced in the settings app as the new
+"Home screen" page (`modules/settings/OverviewConfig.qml`, registered in
+qmldir + both pages arrays). AppGrid clamps user values (cols/rows 1-10, icon
+24-96) with phone defaults as fallback. Device acceptance still open: drawer
+appearance, keyboard-less open + tap-to-type, dock hiding, grid page in
+settings.
+
 ## Goal
 
 The shell's overview (`~/.config/quickshell/souveraine/modules/ii/overview/`)

docs/tasks/51-viewtop-to-daily-driver.md

@@ -28,6 +28,16 @@ three-finger drag that carries a window, floating it via `place()`.
 
 ### The window-action overlay, and why it is blocked on the wire
 
+**2026-08-05: the overlay itself is no longer blocked and now ships (TASK-55).**
+It reaches windows through the control socket's `scene` verbs rather than the
+per-window-texture wire below, which is enough for close/kill/place and is what
+"no way to close an app" needed. What *is* still blocked on this section is the
+**scaled/sliding visuals** — cards, flick-to-dismiss, live miniatures. Note the
+compositor already has the harder half: `pose` scales a real window and
+`unpose` maps input back through the inverse (both tested), so a shrunken app
+stays touchable. Nothing drives `pose` yet, which is precisely why Casey has
+never seen it.
+
 Casey, 2026-08-03: three fingers should raise an **overlay with options** —
 move, resize, close — with the scaled/sliding visuals the reference shell has.
 

docs/tasks/53-viewtop-audit-open.md

@@ -244,7 +244,9 @@ stays lock-only. `socat` is not installed on the phone; a four-line python
 **Still owed, and it needs the PIN** — the 40 is the user's, so an agent cannot
 open the session to check the rest:
 
-- three-finger tap → overview through sessiond, and a three-finger carry;
+- three-finger tap → **the window action sheet** through sessiond (rebound from
+  the overview 2026-08-05, TASK-55 — it now carries the tapped window), and a
+  three-finger carry;
 - a window posed to 0.5 with the border around the *window*;
 - fullscreen from the app and from the dock landing on the same workspace;
 - a palm down mid-drag, and confirming the strip still settles.

docs/tasks/55-hand-verbs-on-the-glass.md

@@ -1,10 +1,55 @@
 # TASK 55 — the hand's verbs: a window action sheet
 
-**Status: open — design questions only, nothing decided.** Created 2026-08-04,
-from Casey: *"I asked for a Three Finger Tap overlay — a couple of buttons:
-Move/Resize, Split, Close. I got three finger tap drag stuff. And I don't have a
-good way to close a running app."* **Repo:** `souveraine-viewtop` (compositor +
-`wire`) and `souveraine` (shell surfaces).
+**Status: 2026-08-05 — the sheet is built, deployed and answering; Split's
+chooser and Home are what remain.** Created 2026-08-04, from Casey: *"I asked
+for a Three Finger Tap overlay — a couple of buttons: Move/Resize, Split,
+Close. I got three finger tap drag stuff. And I don't have a good way to close
+a running app."* **Repo:** `souveraine-viewtop` (compositor + `wire`) and
+`souveraine` (shell surfaces).
+
+## What landed 2026-08-05
+
+Commits: viewtop `9e898dd`, souveraine `bf8bc01` + `f7eba9f`.
+
+- **The tap carries its subject.** `wayland.rs` did `let _ = at;` — the
+  centroid was dropped, so the gesture reached the authority with no window and
+  the binding could only name something global. *That* is why it was bound to
+  the overview. `surface_id_under()` now resolves it through `windows_under`,
+  the same hit test a finger goes through, and it travels through
+  `Report::Gesture` → `gesture(fingers, gesture, target)` → `Request::Gesture`.
+- **Q1 answered — the tap is the sheet.** `Action::Overview` is gone (it had no
+  other producer); `Action::WindowSheet { target }` replaces it.
+- **Q4 answered — kill is the hand's** (Casey: "Kill is the hands... a later
+  guard for privileged apps if need be"). New `ToCompositor::Kill`, because
+  `Close` is a request a hung client never reads. **pid < 2 is refused**:
+  `get_credentials` answers `-1` when it cannot identify a peer and
+  `kill(-1, SIGKILL)` signals every process the uid owns.
+- **Q8 answered — a tap on the wallpaper is inert**, recorded with
+  `bound: false` rather than raising an empty sheet.
+- **Q6 addressed** — the sheet does not inherit the chip's root cause: 76 px
+  circles, 34 px glyphs, against the chip's 44 px / 18-20 px.
+- **The shell can address the scene at all.** `services/ViewtopControl.qml` is
+  the single path to viewtop's `scene` op (place/pose/close/kill/raise/focus).
+  Before it, no shell surface could reach a window verb.
+- **Q2 deferred by Casey**, not by omission: the dial is "quick options in the
+  making... comprised of duplicate functionality mostly", so the sheet stays
+  independent of it for now.
+
+**Not done:** Split pins the window to the top half and says so on screen — the
+chooser (pick from open apps, or an app list, for the other half) has no verb
+(Q3). Resize is a fixed half-height `place`, not a drag handle. Home (Q5) is
+untouched and still `hyprctl`.
+
+**Found while doing it, and worth its own fix:** on a *runtime* lock the panel
+shows black until the shell's lockscreen paints. TASK-03's boot timeline
+(splash → sessiond's glance → rich lockscreen) has no runtime equivalent —
+`sessiond/lock.rs` raises the glance only when `shell_alive` is false, and
+`frame_elements` composites lock surfaces *and nothing else*, so an unpainted
+one is an empty scene. The trail shows the decisions are correctly ordered
+(`lock-before-blank` → `lock-directive` → `panel-off`); it is a presentation
+gap, not an ordering bug. Casey's rule: lock, confirm the lockscreen is up,
+*then* blank — which is viewtop's to attest, since only the compositor knows a
+lock surface is presented on every output.
 
 The gesture recognition is built, the binding exists, and it points at the wrong
 thing. What is missing is the surface the recogniser's own header promised: *"the

docs/tasks/README.md

@@ -62,7 +62,7 @@ Four that are cheap relative to what they unblock:
 | 58 | [Host power: the SMB2 OTG boost](58-host-power-smb2-boost.md) | Host data works; the boost isn't. The SMB2 5 V boost exists in silicon and mainline's `qcom-smbx-charger` never registers it. Investigation first (which tree builds the running kernel, does smb2 touch the boost, does `qcom_pmic_typec` bind pmi8998), then vbus-supply + regulator + typec. Unlocks host-mode power, power-bank mode, and the Pi without a wall wart. |
 | 57 | [The Pi dock head](57-pi-dock-head.md) | Phone stays a gadget; the Pi 4 drives the monitor + dock. NCM link is default, Venus encoder is present, compositor capture landed — the unproven seams are `zwlr_screencopy` vs our own capture IPC, and the Pi's own bring-up ("major malfunctions TBD"). Four phases: Pi bring-up, static chain, real capture + udev trigger, input injection. |
 | 56 | [The island, and the bar's honest face](56-island-and-the-bars-honest-face.md) | Bar clears a region for sprawling notification banners, agent-controlled (Part A: design questions). Part B is buildable now: drop the LTE suffix, tap-to-cycle the carrier name (Fido → Casey → Fimeg), and a network-type indicator that shows the live connection instead of a wifi glyph that never reflects cellular. |
-| 55 | [The hand's verbs: a window action sheet](55-hand-verbs-on-the-glass.md) | Design questions only. Three-finger tap currently opens the same overview the rail reaches; the sheet needs Move/Resize/Split/Close with real verbs, and Home must become a compositor verb — the rail's is `hyprctl` and dies under viewtop. |
+| 55 | [The hand's verbs: a window action sheet](55-hand-verbs-on-the-glass.md) | **Sheet built and deployed 2026-08-05.** The tap carries its window now (the centroid was being dropped, which is why it could only reach the overview); `Kill` added because `Close` is a request a hung client never reads; `ViewtopControl.qml` is the shell's one path to the scene verbs. Left: Split's chooser, a real resize handle, and Home (still `hyprctl`). Also surfaced a runtime-lock paint gap — black until the lockscreen draws, because only boot has a splash→glance→lockscreen chain. |
 | 52 | [Atmosphere](52-atmosphere.md) | Attention as a compositor capability — the fifteen-technique vocabulary. Two are **already landed** (`expose` is negative space, `pose` is gravity wells), and `compile_custom_pixel_shader` + `PixelShaderElement` are already in our smithay, so most of the rest needs no new machinery. Build the attention model and one clock **first**; fifteen uncoordinated animators is §1's blind actors in the render path. |
 | 50 | [Her hand on the glass](50-agent-hand-on-the-glass.md) | Every scene intent reaches the compositor now **except touch** — so she can move, scale, dim and close a window and cannot press anything inside one. The receiving end is built (`Origin::Agent`, the disjoint slot namespace, the evidence predicate); nothing calls it, so she still reaches touch through uinput, which is the exact conflation `input.rs` exists to prevent. Also owns the inverse mapping `pose` owes the hit test. |
 | 51 | [viewtop to daily driver](51-viewtop-to-daily-driver.md) | The punch list between *runs* and *stable*, all of it found by using the phone: windows stack with nothing to tell them apart, screen capture is written and unmerged (so no UI change can be verified), volume buttons are recognised and dropped, and five named holes that are one decision each. |