task 53: verified on the phone; two more found by running it

docs/tasks/53-viewtop-audit-open.md

@@ -1,10 +1,26 @@
 # TASK 53 — what an audit of the 2026-08-03 compositor work left open
 
-**Status: the ten findings are fixed and pushed** (`souveraine-viewtop ba82168`,
-2026-08-04). **Not yet run on hardware** — the binary is staged on the phone at
-`/usr/local/bin/viewtop.ba82168` and lands on an install + greetd restart.
-Created 2026-08-04 from an adversarial read of `ba4bd03..c98f4c8` and
-`souveraine 266af98..914e48f`. **Repo:** `souveraine-viewtop` unless noted.
+**Status: the ten findings are fixed, pushed, and on the phone**
+(`souveraine-viewtop 6446386`, installed 2026-08-04, greetd restarted, session
+came back and locked). Created 2026-08-04 from an adversarial read of
+`ba4bd03..c98f4c8` and `souveraine 266af98..914e48f`. **Repo:**
+`souveraine-viewtop` unless noted.
+
+**Two more defects the hardware found that four gates did not**, which is the
+whole argument for this section existing:
+
+- **`delivered` was a lie.** `touch_down` on a *locked* session answered
+  `{"delivered": true}` while `resolve` had withheld the contact and nothing had
+  been sent to anyone. The field was `is_down`, and a withheld contact is still
+  tracked on purpose — evidence is about the finger, not about where the event
+  ended up. Holding a slot and reaching a client are two questions; `delivers()`
+  is the second one. Fixed in `bed1ed6`, re-measured `delivered: false`.
+- **A drift warning that fired on the normal path.** `prune_workspaces` derives
+  membership from the surface table, so it dropped the closing window's own
+  entry and reported "membership outlived its windows" on *every* window close.
+  A signal that fires when nothing is wrong is not a signal — §4's rule pointed
+  at itself. The ordinary close removes its own entry now and the sweep warns
+  only on real drift (`6446386`).
 
 Six findings from that audit were fixed the same day (the strip not moving,
 agent touch reaching the lock surface, the stale settle stranding the strip, the
@@ -184,14 +200,29 @@ it.
 
 ## Acceptance
 
-Not met yet. It is one thing: **launch an app and read the log**, then
+**Verified on the phone 2026-08-04**, session locked, over the control socket
+and with real clients:
 
-- open two windows, three-finger tap (overview reaches sessiond), three-finger
-  carry one (it floats), `unplace` it (it tiles again);
-- pose a window to 0.5 and check the border is around the *window*;
-- close a window and watch for a grey frame that should no longer exist;
-- fullscreen from the app and from the dock and get the same workspace;
-- put a palm down mid-drag and confirm the strip still settles.
+- the session comes up and locks — lock granted and attested to `peer:7
+  (uid 1000)`, every layer surface mapped, and **no refusal from the new
+  `Privileged::WindowList` filter**. That was the deployment risk worth naming:
+  2026-08-03 closing five bind filters left the phone unable to lock.
+- `state` reports `borders` — the read-back §4 asked for.
+- a slot outside the namespace: `invalid_argument`, *"slot 4294967295 is outside
+  the agent's namespace of 64"*.
+- `unplace` end to end on a live window: `was_floating: false` → `place` →
+  `was_floating: true`. §9's one-way door has a return.
+- two windows tile on one workspace, closing each leaves the strip at 1 with no
+  phantom room, and the log is clean — zero warnings that are not smithay's own
+  two (`drm master`, `mode property blob`).
+
+**Still owed, and it needs the PIN** — the 40 is the user's, so an agent cannot
+open the session to check the rest:
+
+- three-finger tap → overview through sessiond, and a three-finger carry;
+- a window posed to 0.5 with the border around the *window*;
+- fullscreen from the app and from the dock landing on the same workspace;
+- a palm down mid-drag, and confirming the strip still settles.
 
 ## Connects to
 

docs/tasks/README.md

@@ -29,7 +29,7 @@ Four that are cheap relative to what they unblock:
 
 | # | Task | What's left |
 |---|------|-------------|
-| 53 | [viewtop audit: what it left open](53-viewtop-audit-open.md) | All ten findings fixed and pushed (`ba82168`). **Unverified on glass** — the binary is staged on the phone and lands on an install + greetd restart. The acceptance list is in the task. The lesson stands: all of it passed four gates before *and* after. |
+| 53 | [viewtop audit: what it left open](53-viewtop-audit-open.md) | All ten fixed and **on the phone** (`6446386`). Hardware found two more the gates did not — `delivered` reported true for a withheld contact, and a drift warning that fired on every normal close. What is left needs the PIN. |
 | 43 | [viewtop: the Souveraine compositor](43-viewtop-compositor.md) | Runs on the phone. Next lane is the ext-session-lock admission gate. The two-client lock handoff is the thing not to get wrong. |
 | 29 | [SouveraineOS Updater](29-souveraine-updater.md) | Ships and installs by `pacman -Syu`. **Read-only on device** until something runs a polkit agent — that is the shell's job. Also owns TASK-42's layer 2. |