tasks: archive 05 — crash surfacing done, kill-test verified

docs/tasks/05-crash-reporter.md

@@ -1,51 +0,0 @@
-# TASK 05 — Crash reporter surfacing
-
-**Status:** half-landed. Supervision is done; surfacing is not.
-
-## Goal
-
-When the shell or a user service crashes, it gets *reported* — a banner /
-sensoria event — not just silently survived. Today the supervision half
-journals and restarts but nobody tells the user a crash happened.
-
-## Context — what's landed
-
-`Pixel3Arch d230764` — `souveraine-shell.service`:
-- Type=exec, Restart=on-failure, RestartSec=2, gives up after 8 tries
-  (StartLimitBurst=8 / 120s) so sessiond's fail-closed lock stays in charge.
-- `ExecStopPost` appends non-clean exits to
-  `~/.local/state/souveraine/crashes.log`:
-  `timestamp result=$SERVICE_RESULT exit=$EXIT_STATUS`.
-- stderr journaled.
-
-## What's not landed — the surfacing half
-
-Watch three sources and emit a notification (needs TASK-04):
-1. New lines in `~/.local/state/souveraine/crashes.log`.
-2. New `coredumpctl` entries (`coredumpctl list` diff).
-3. `systemctl --user --failed` units.
-
-On a new entry, fire a notification through the TASK-04 server: banner
-unlocked, lock card locked, sensoria event for the agent.
-
-## Steps
-
-1. Land TASK-04 (notification server) first — this task emits through it.
-2. Small watcher: tail the three sources, dedupe, emit. Could be a
-   quickshell service or a tiny Rust binary in the substrate. Keep it
-   simple — inotify on crashes.log, a periodic coredumpctl/systemctl
-   poll (no tight polling loop; 30s is fine, and remember no polling
-   wakeups that burn power).
-3. Rate-limit: one crash reported once, not a storm during the 8-retry
-   window.
-
-## Acceptance
-
-Kill `qs` from an ssh shell. Within seconds, a visible notification says
-the shell crashed and whether it recovered. The 8-retry give-up state is
-reported distinctly (shell down, lock fail-closed).
-
-## Connects to
-
-TASK-04 (emits through it), TASK-02 (a crashed shell's glance is the
-sessiond recovery surface).

docs/tasks/README.md

@@ -15,7 +15,6 @@ plus open threads from the 2026-07-17 session.
 | 1 | [Favorites — wife's name on her number](01-favorites-contacts.md) | blocked | needs a contacts-store decision (qtpim retired — see archive/06) |
 | 2 | [Lockscreen-as-Rust-system: glance + swipe](02-lockscreen-rust-system.md) | in progress | stopgap shipped 2026-07-17 |
 | 3 | [Boot timing: fade splash → lock, no extra fixes](03-boot-timing-splash-to-lock.md) | open | paired with TASK-11 (now archived) |
-| 5 | [Crash reporter surfacing](05-crash-reporter.md) | half-landed | unblocked — TASK-04 done, notify pipe live end to end |
 | 7 | [WCD9340 mic: SLIM TX channel/port contract](07-mic-wcd9340-slim-tx.md) | diagnosed | frontier; pairs with kernel series |
 | 8 | [Device state manager / power profiles](08-device-state-manager.md) | open | blocked-by TASK-09 suspend item |
 | 9 | [Suspend-resume FTS calibration race](09-suspend-resume-fts.md) | interim-fix | kernel-side; cold-boot only |
@@ -23,7 +22,9 @@ plus open threads from the 2026-07-17 session.
 | 13 | [Active Edge (squeeze) as a sensor input](13-active-edge-squeeze.md) | open | substrate up; bring-up unit not drafted |
 | 14 | [Overview pane → phone app grid](14-overview-appgrid.md) | open | shell-side; appgrid prior art linked in-file |
 
-Archived (see `archive/`): 04 notification server — done 2026-07-21,
+Archived (see `archive/`): 05 crash reporter — done 2026-07-21,
+CrashReporter.qml in-shell watcher, kill-test verified on device;
+04 notification server — done 2026-07-21,
 server already existed (quickshell owns the name), built the lock card +
 NotifyEvents seam; 06 qtpim build — retired 2026-07-20, qtpim is
 no longer the contacts path; 10 boot chain — done, we ship our own

docs/tasks/archive/05-crash-reporter.md

@@ -0,0 +1,38 @@
+# TASK 05 — Crash reporter surfacing
+
+**Status:** done 2026-07-21. Supervision half landed earlier
+(Pixel3Arch d230764); surfacing half is `services/CrashReporter.qml`
+(souveraine ad5be0a).
+
+## Design
+
+The watcher lives inside the shell deliberately: when qs dies, systemd
+resurrects it and the fresh instance finds the new crashes.log line and
+announces its own recovery. The 8-retry give-up case has no shell to
+banner from — sessiond's fail-closed lock IS that surface, by design.
+
+Emission is a real `notify-send`, not a shortcut into the Notifications
+singleton — the crash report exercises the same D-Bus pipe every client
+uses, so a broken pipe is itself detected.
+
+Sources: crashes.log via FileView inotify (no polling); `systemctl
+--user --failed` and `coredumpctl list` tail on one 30s timer. Dedupe
+cursors persist in `~/.local/state/souveraine/crash-reporter.state`, so
+a crash reports once across restarts. First run baselines history
+silently (the pre-existing ModemManager SIGSEGV of 2026-07-20 was
+correctly swallowed as baseline).
+
+## Verified on device
+
+`pkill -9 qs` → ExecStopPost appended `result=signal exit=KILL` →
+shell back in ~10s → lock card shows the souveraine crash notification
+(screenshot). State cursor advanced 8→9, exactly one report.
+
+## Leftovers
+
+- Give-up state (8 crashes/120s): shell stays down, sessiond holds the
+  fail-closed lock. If that needs an out-of-shell reporter someday, it
+  is a tiny substrate binary watching the same log — nothing here
+  precludes it.
+- Coredump reporting takes the `coredumpctl list` tail; a burst of
+  dumps between polls reports only the newest. Fine for the purpose.