Fimeg/SouveraineOS
Watch
1
0
Fork
You've already forked SouveraineOS
 0
Code Releases Activity

docs: lock-before-blank is an invariant; note the missing deploy lease

Browse source 
LOCK-DPMS-LESSONS §1: the idle clause described 300s-lock-before-600s-blank,
which no longer exists. sessiond enforces the ordering now.

TASK-08: record that (e) is still missing — restarting the shell over a locked
session still hits "Tried to show lockscreen surfaces without active lock".
Reproduced during this deploy.
This commit is contained in:
Fimeg 2026-07-25 19:19:47 -04:00
commit 45a4e44392
2 changed files with 16 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

18
docs/LOCK-DPMS-LESSONS.md
View file

@ -17,9 +17,21 @@ wake that races the lock can land input on an unlocked surface.
unlocked in a pocket is not.
- Suspend: `PrepareForSleep` → lock secure → release the delay inhibitor.
Fail-closed, ~5s budget.
- Idle: the native IdleCoordinator locks (300s) well before hypridle's
dpms-off (600s) and suspend (900s), so idle blanking always finds the
session already locked.
- Idle: **sessiond enforces it.** Every path to a dark panel routes through
`request_blank()` in `device_state.rs`, which locks first, waits
`LOCK_ACK_BUDGET` (2s) for the compositor ack, and blanks anyway on timeout
while recording an `error-security` — the panel fails open, the *claim*
never does (doctrine §8).
**This used to be a coincidence and is now an invariant** (2026-07-25). The
line here previously read "the native IdleCoordinator locks (300s) well before
hypridle's dpms-off (600s), so idle blanking always finds the session already
locked." That was true only because 300 < 600 — two numbers in a config file.
Anything that skipped the 300s lock (an idle inhibitor, the native coordinator
disabled, a dead shell) still met the 600s blank, and the screen went dark on
an unlocked session with nothing said about it. hypridle's listeners are now
deleted (Pixel3Arch `cadaec9`); do not re-add one. A timer in that file cannot
see the lock, and that blindness *is* the bug.
## 2. One DPMS authority

2
docs/tasks/README.md
View file

@ -16,7 +16,7 @@ plus open threads from the 2026-07-17 session.
| 2 | [Lockscreen-as-Rust-system: glance + swipe](02-lockscreen-rust-system.md) | in progress | stopgap shipped 2026-07-17 |
| 3 | [Boot timing: fade splash → lock, no extra fixes](03-boot-timing-splash-to-lock.md) | diagnosed | EBUSY handoff race is the last timing bug; splash text killed, holder added |
| 7 | [WCD9340 mic: functional-pinned; unpin + fidelity](07-mic-wcd9340-slim-tx.md) | functional 07-20 | defect: power pin; kernel `mic-race-fix` |
| 8 | [Device state manager / power profiles](08-device-state-manager.md) | actuating 07-25 | machine has a clock and blanks the lock screen; (b) charge real, (c)(d)(e) open |
| 8 | [Device state manager / power profiles](08-device-state-manager.md) | actuating 07-25 | clock + actuators; lock-before-blank is an invariant and hypridle's listeners are deleted; (b) charge real, (c)(d) open, **(e) lease still missing — a shell deploy over a locked session still crashes the lockscreen** |
| 9 | [Suspend-resume FTS calibration race](09-suspend-resume-fts.md) | interim-fix | kernel-side; cold-boot only |
| 12 | [Face auth as a capability factor (Gaze reference)](12-gaze-reference-face-auth.md) | open | per-target: phone needs front-cam bring-up |
| 13 | [Active Edge (squeeze) as a sensor input](13-active-edge-squeeze.md) | open | substrate up; bring-up unit not drafted |