DUMP: the session that retired flashing

STATE.md

@@ -182,5 +182,7 @@ to Gitea (`Fimeg/Chatty`, `Fimeg/libcmatrix`, `Fimeg/qtpim`).
 - `DUMP-*.md` — per-session bootstrap dumps; write one per working session
   that changes cross-repo state.
 - `session-trust-map.html` — moved from ~/ on 2026-07-16.
+- `DUMP-pacman-pipeline-2026-07-24.md` — the session that retired flashing:
+  pacman pipeline, the eleven unowned binaries, and the traps found.
 - DEPRECATED: `qtpim-contacts-handoff.md`, `contacts-design.md`,
   `chatty-matrix-features.md` — historical, superseded by Matrix sensorium.

docs/DUMP-pacman-pipeline-2026-07-24.md

@@ -0,0 +1,133 @@
+# DUMP — the phone stopped needing flashes (2026-07-24 → 07-25)
+
+Twelve-hour session. One sentence: **the Pixel 3 is now a normal Arch box that
+updates with `pacman -Syu`, kernel included, and every Souveraine binary on it
+is finally owned by a package.**
+
+Read `docs/tasks/25-one-repo-all-packages.md` for the design. This is the
+session record — what changed, what broke, what is still open.
+
+## The root problem, found early
+
+Casey asked why upower reported `charge-type: unknown` after a day of work.
+The answer turned out to be structural, not a bug:
+
+- **Eleven souveraine binaries on the phone were hand-copied to
+  `/usr/local/bin` and owned by no package.** `pacman -Qo` → "No package owns".
+  They had never once received an update.
+- `souveraine-sessiond` was therefore still the Jul 19 build. The unified
+  device state machine (`b4b30b1`) had never run on the device.
+- The fix Casey wrote that morning (`628283f`, "kernel spells
+  CHARGE_TYPE_NONE as N/A") **had never been pushed** — it existed only in the
+  local working tree, and the souveraine submodule was pinned one commit
+  behind it.
+- CI's upower steps had never produced a green build. Proof: the Jul 13 `edge`
+  release contains no upower package at all.
+
+## Landed and verified on hardware
+
+**Kernel, installed by pacman — no flash.** `7.1.1-sdm845-g58892902459c`,
+built on archdev from the gitea tip `588929024`, `pacman -U`'d over ssh,
+survived a cold boot. Charge control is live for the first time:
+
+    /sys/class/power_supply/pmi8998-charger/
+      charge_control_end_threshold  99        voltage_max  4395000
+      charge_type                   N/A       constant_charge_current_max 1950000
+
+`charge_type` reading literally `N/A` confirms Casey's fix was correct against
+real hardware, not just inferred. **This unblocked TASK-08(b)** — that task
+still said mainline exposes no charge-threshold sysfs; corrected.
+
+**Why no flash was needed.** pocketboot reads `/boot/extlinux/extlinux.conf`
+off `Arch_root` (XBOOTLDR type GUID) and boots the fixed names
+`/boot/vmlinuz-blueline` + `initramfs-blueline.img`. `boot_a` is **stale** —
+its embedded cmdline still has `pmos_root_uuid` and no `root=`/`fbcon=map:1`,
+so it is not in the boot path; flashing it changes nothing. The gap was that
+mkinitcpio writes *versioned* names and someone had been copying them onto the
+generic ones by hand. Closed by `95-blueline-extlinux.hook` →
+`blueline-promote-boot` (both in `Pixel3Arch/rootfs-overlay/`).
+
+**Everything packaged.** `souveraine`, `-secrets`, `-machined`, `-sessiond`
+(aarch64 only — the laptop hits lock-screen errors with sessiond) now install
+to `/usr/bin` from the signed repo. The cutover script backed up every binary
+and unit, removed the three overrides pinning `/usr/local/bin`, and restarted
+services with sessiond **last and alone**; the session lock was re-acquired
+and `LockedHint=yes` held throughout.
+
+**The state machine is running.** Confirmed over IPC:
+
+    device_state -> {"device_state":"active","display_active":true,
+                     "observed_confidence":0.0,"phase":"released",
+                     "shell_alive":true,"suppress_dpms_wake":false}
+
+Still **observational** — it logs, it drives nothing. Idle timeouts remain
+hypridle's (300s lock / 600s screen off). `forensic_log` returns `count:0`.
+
+**pachub 2.0-2** built on archdev and installed, carrying the touch-input and
+phantom-row fixes.
+
+## Traps found (all cost real time — do not re-derive)
+
+- **`DownloadUser` + a custom `XferCommand` are incompatible.** Pacman execs
+  the external command as that user but hands it a path inside the root-owned
+  sync dir; it only creates the alpm-owned `download-*` staging dir for its
+  *internal* downloader. Every repo fails EACCES on `core.db`, long before the
+  souveraine repo is reached. Unset `DownloadUser`.
+- **`DisableSandboxFilesystem` / `DisableSandboxSyscalls` are not pacman
+  options.** They sat in the phone's `pacman.conf`, silently ignored, leaving
+  `pacman -Sy` broken since ~2026-07-23. pacman 7.1 has only `DisableSandbox`,
+  which governs landlock and does not help here either.
+- **A `+` in a gitea release asset filename cannot be fetched.** It is stored
+  decoded as a space; both `+` and `%2B` 404. Package versions must avoid it —
+  use `.r<sha>`. (The database itself records `+` fine; only the download 404s.)
+- **Version schemes must match upstream, not souveraine's.** `upower-souveraine`
+  built as `0.1.rN` sorts *below* the hand-built `1.91.3+<sha>`, so `-Syu`
+  read the repo copy as a downgrade and silently skipped it.
+- **The package must not claim `org.freedesktop.secrets.service`** —
+  gnome-keyring owns that path. `souveraine-secrets` holds the bus name at
+  runtime; stealing the D-Bus activation file is the two-authorities collision
+  the session-authority doctrine warns about.
+- **upower installs to `usr/libexec/upowerd`, not `usr/lib/`.** Two separate CI
+  assertions had the wrong path and failed on good builds.
+- **cargo deadlocks on itself** if `<target>/release` and
+  `<target>/<triple>/release` are the same inode. A symlink there hangs the
+  build forever in `locks_lock_inode_wait` with zero rustc running. Use a real
+  directory + a post-hoc copy.
+- **Do not run cargo on archdev while CI is running** — the shared
+  `~/.cargo/.package-cache` lock kills the packaging job.
+
+## Cross-compiling on archdev
+
+binfmt for aarch64 is registered on the **Proxmox host** (`leaf`,
+10.10.20.125) with the `F` flag, which is what makes it usable from the
+unprivileged archdev container. Registering inside the container fails —
+`/proc/sys/fs/binfmt_misc/register` is EACCES even as root.
+
+`~/aarch64-sysroot` is populated from `~/build/pkgcache/` (565 real ALARM
+packages) and its versions match the phone exactly — verified. **Never**
+substitute a freshly downloaded ALARM rootfs; it would link against different
+versions than the device runs.
+
+squeekboard cross-compiles (`Pixel3Arch/pkgs/squeekboard/build-cross.sh`,
+five documented fixes). The binary is built and verified aarch64 with correct
+soname deps, but is **not yet packaged**.
+
+## Open
+
+1. **upower still not installed.** CI run `155288d` carries the `.r` version
+   fix; once green, `pacman -Syu` upgrades it and `charge-type` goes live.
+2. **`kernel.yml` has no `repo-add --sign`** — it publishes raw packages, so
+   kernels are still fetched and `pacman -U`'d by hand. This is the last piece
+   of TASK-25.
+3. **Unpackaged:** squeekboard, stevia, `souveraine-player` (own repo),
+   `souveraine-splash` (aarch64 ELF, source not located in `~/Projects`).
+4. **The shell surfaces, settings included, are unpackaged** and live in
+   `$HOME`. That is the next stage Casey named — see the note in TASK-25.
+   Ordering matters: charge control can be exposed honestly *now*;
+   state-machine controls must wait for TASK-15/08 to give it actuators, or
+   they are the "success-shaped switches" TASK-19 forbids.
+5. **Docs corrected this session:** TASK-08(b) (charge control unblocked),
+   `Pixel3Arch/CLAUDE.md` (new — do not flash), `SouveraineOS/STATE.md`,
+   `souveraine/CLAUDE.md`. `Pixel3Arch/PAF/HANDOFF-upower-charge-control.md`
+   is now stale in two places: gitea has both "LOCAL ONLY" commits, and the
+   userspace CLI was fixed by `b5818ff`.