STATE: phone updates with pacman; flashing retired

STATE.md

@@ -9,7 +9,40 @@ this state file. Component repos keep their own repo-local PAF/ docs; what
 crosses repo boundaries lives here. Update this file when component state
 moves; it is the resume anchor.
 
-Last updated: 2026-07-21 (deprecated Chatty/libcmatrix/qtpim, cleaned refs).
+Last updated: 2026-07-24 (phone updates via pacman; flashing retired).
+
+## DEPLOYMENT — the phone updates with pacman. Do not flash.
+
+**As of 2026-07-24 the Pixel 3 is a normal Arch box: `pacman -Syu` from the
+Gitea repo. That includes the kernel.** The phone is Casey's daily driver — a
+reprovision costs him his live system — so reaching for fastboot is a
+regression, not a fallback.
+
+- Repo: `[souveraine-aarch64]` → the rolling `edge` release of
+  `Fimeg/souveraine`, `SigLevel = Required DatabaseRequired`. Wiring lives in
+  `Pixel3Arch/rootfs-overlay/` so a reprovision cannot lose it again (it was
+  configured live once and vanished at the next flash).
+- Kernel: installs like any package. pocketboot boots `/boot/vmlinuz-blueline`
+  via extlinux on `Arch_root` (XBOOTLDR type GUID); the pacman hook
+  `95-blueline-extlinux.hook` → `blueline-promote-boot` copies the versioned
+  kernel + initramfs onto those generic names. **`boot_a` is stale** — it still
+  carries `pmos_root_uuid` and no `root=`, so it is NOT what boots the system.
+  Flashing it changes nothing.
+- Everything is packaged: `souveraine`, `-secrets`, `-machined`, `-sessiond`
+  (aarch64 only — the laptop hits lock-screen errors with sessiond),
+  `upower-souveraine`, kernel. Nothing belongs in `/usr/local/bin` any more.
+
+**Real reasons to flash, and only these:** the boot chain itself is broken
+(pocketboot/extlinux/initramfs unbootable), partitioning changes, or a
+deliberate from-scratch reprovision. A new kernel is not one of them.
+
+**NEVER build on the phone.** archdev (`casey@10.10.20.123`) cross-compiles
+everything, including meson+cargo projects — see
+`Pixel3Arch/pkgs/squeekboard/build-cross.sh` for the pattern. binfmt for
+aarch64 is registered on the Proxmox host with the `F` flag, so the
+unprivileged archdev container can execute aarch64 binaries.
+
+Full design + traps: `docs/tasks/25-one-repo-all-packages.md`.
 
 ## Component repos