docs: state machine audit 2026-07-26; retire TASK-26 references

DEVICE-STATE-MACHINE §0: the audit, in the doc rather than a new task file.
Lock shadow copy found and fixed (doctrine §4). Two open: proximity has no
debounce and thrashed 69 transitions in 40min (§9.5 already specifies the fix),
and forensic.jsonl sits on tmpfs — RAM, wiped on reboot, unbounded.

TASK-26 was never written and no longer needs to be: the proximity second
authority is resolved, packaging is TASK-27. Dangling refs in STATE.md,
TASK-25 and TASK-27 now say that instead of pointing at a missing file.

STATE.md

@@ -39,7 +39,8 @@ regression, not a fallback.
 - **5,624 files under `/usr /etc /opt /boot` are still owned by nothing** —
   the same disease, not yet colliding. One of them,
   `blueline-proximity-lock`, is a running second authority over proximity
-  (TASK-26). Inventory + the conflict-computation recipe: TASK-25.
+  (resolved 2026-07-25 — it reports to sessiond and decides nothing; packaging
+  is TASK-27). Inventory + the conflict-computation recipe: TASK-25.
 
 **Real reasons to flash, and only these:** the boot chain itself is broken
 (pocketboot/extlinux/initramfs unbootable), partitioning changes, or a

docs/DEVICE-STATE-MACHINE.md

@@ -35,6 +35,38 @@ Still open: the sensor feeder (`sensor_input` has senders now via
 (TASK-15, blocked on slice separation), and both confidence gates are still
 computed and logged without being branched on.
 
+## 0. Audit, 2026-07-26 — what the running machine actually did
+
+Measured on hardware, 40 minutes after a cold boot. Kept here rather than in a
+new task file: this section IS the audit.
+
+**FIXED — the machine kept a shadow copy of lock state, and it drifted.**
+`device_state: locked, locked: true, panel_on: false` while
+`loginctl show-session 1 -p LockedHint` said `no`. The screen was dark on an
+unlocked session. `locked_ack` was the only lock ingress and there was no
+unlock ingress outside sessiond's own fallback PIN surface, so after the first
+unlock the machine believed it was locked forever. Every `is_locked()` rule
+then ran against an in-use phone: proximity blanked it (that rule's
+`is_locked` guard was correct — the *state* was lying), and blanks never asked
+for a lock first because one was "already held". This is doctrine §4 verbatim:
+"never a hand-tracked bool. A shadow copy can disagree with logind." Fixed by
+`lockhint.rs` — logind is read, not mirrored.
+
+**OPEN — proximity has no debounce, and it thrashes.** 69 transitions and 68
+sensor inputs in 40 minutes, `Locked → Observed → Locked` flapping on a
+sensor with no hysteresis. §9.5 of this document already specifies the fix and
+it was never built: Android's `DisplayPowerProximityStateController` uses 0 ms
+positive debounce and **250 ms negative** — near suppresses immediately, far
+waits before being believed. Every flap writes a forensic entry, so this is
+also most of the log volume below.
+
+**OPEN — the forensic trail is neither durable nor bounded.**
+`$XDG_RUNTIME_DIR/souveraine/forensic.jsonl` is on tmpfs: it is RAM on a 3.5 GB
+phone and it is erased on every reboot. 104 KB accumulated in 40 minutes
+(~3.6 MB/day) with no rotation. §5 calls this trail "tamper-evident" and pairs
+it with the SessionAudit hash chain, which a file that evaporates on reboot
+cannot be. Two separate decisions are owed: where it lives, and what bounds it.
+
 Two divergences to settle when wiring, code-first per doc precedence:
 - The `Locked → Observed` transition keys on **raw `proximity_near`**, not on
   the §4 threshold table.

docs/tasks/25-one-repo-all-packages.md

@@ -160,7 +160,8 @@ same disease as the eleven binaries, just not yet colliding: 16
 `chatty.orig-pacman` / `chatty.pacman-orig` leftovers.
 
 One of them, `blueline-proximity-lock`, is not merely unpackaged — it is a
-**running second authority** over proximity. See TASK-26.
+**running second authority** over proximity. Resolved 2026-07-25: it reports
+to sessiond and decides nothing. Only its packaging remains, under TASK-27.
 
 **`pacman -Syu` had been blocked for days by exactly one of these files.**
 Intersecting the unowned set against the 112,051 files shipped by the 199

docs/tasks/27-gitea-pipeline-audit.md

@@ -209,6 +209,6 @@ finding 6 happened, and nothing isolates the next one.
 
 ## Connects to
 
-TASK-25 (the design and the archive shape), TASK-26 (`blueline-proximity-lock`
+TASK-25 (the design and the archive shape), the absorbed proximity-authority work (`blueline-proximity-lock`
 as an unowned second authority — now demoted to a reporter, still unpackaged),
 `Pixel3Arch/PAF/build.md`, `souveraine/packaging/arch/`.

docs/tasks/README.md

@@ -55,11 +55,12 @@ proximity-blanks-locked-screen needs sensors back (SLPI, TASK-09 neighbours),
 and the shell handshake needs a cold boot — restarting sessiond mid-session
 drops `shell_alive` (that gap is TASK-28).
 
-**TASK-26 was never written**, though `STATE.md` and TASK-25 both cite it. Its
-subject was `blueline-proximity-lock` running as a second authority over
-proximity. Half of that is resolved: as of 2026-07-25 it reports to sessiond
-and decides nothing. It is still unpackaged, which is TASK-27's problem. Delete
-the dangling references or write the file — do not leave both.
+**TASK-26 was never written and no longer needs to be.** Its subject was
+`blueline-proximity-lock` running as a second authority over proximity. That is
+resolved: as of 2026-07-25 it reports to sessiond and decides nothing, and its
+one remaining loose end (unpackaged) belongs to TASK-27. The dangling references
+in `STATE.md`, TASK-25 and TASK-27 now say so instead of pointing at a file that
+does not exist.
 
 ## Conventions