PAF becomes saf/device (history kept), STATE.md dissolves
into saf/state.md with the dated era archived, the substrate
SAF moves up from souveraine, and every agreement points at
saf/INDEX.md and nowhere else. one map, nothing to remember
Twelve completed or superseded task records leave the live queue; the byte-identical rename duplicate is removed.\n\nThe authority and somatic source records now point at SAF, while tasks 33, 48, 49, 53, 60, and 76 say what is actually left.
The r506 build had ChargeEvidence reading sysfs from sessiond's clock with
conclusion() inside the driver type — the rule violated four times in one
object. Recorded here: the ruling (§4), the task reconciliation, and the
bearer audit under the same rule. Also the corrected cutover answer: the
laptop is the test bed, the chooser is phone-shaped, mechanism undecided.
TASK-26 had two subjects. Yesterday's note closed the proximity-authority
half and read past the other one — evidence-source health, which is what
PAF/slpi.md was actually pointing at. Built now, so both are closed.
TASK-28 gains two measured cases: the reporter/sessiond split-delivery
order, and sessiond restart putting up the fallback PIN surface.
DEVICE-STATE-MACHINE §0: the audit, in the doc rather than a new task file.
Lock shadow copy found and fixed (doctrine §4). Two open: proximity has no
debounce and thrashed 69 transitions in 40min (§9.5 already specifies the fix),
and forensic.jsonl sits on tmpfs — RAM, wiped on reboot, unbounded.
TASK-26 was never written and no longer needs to be: the proximity second
authority is resolved, packaging is TASK-27. Dangling refs in STATE.md,
TASK-25 and TASK-27 now say that instead of pointing at a missing file.
DEVICE-STATE-MACHINE.md said "partly built and entirely inert" and the archived
deploy task said "observational only". Both were written 2026-07-25 midday and
were overtaken by aa30278 the same afternoon. tasks/README.md already said
"actuating 07-25" — the index was right and the design docs were two hours
behind, which read as a live blocker on TASK-25's ordering note ("state-machine
controls must wait for TASK-15/08 to give it actuators").
Doctrine: where docs and code disagree, the code is right.
Also records the second pass: lock-before-blank is now an invariant enforced in
the authority, and hypridle's competing listeners are deleted.
TASK-26 duplicated this doc and should not have been written. The doc
already covers the seven-actor scatter, the evidence model, the
proximity-lock/screen-toggle mapping, and names sessiond as the owner.
Corrects the status: b4b30b1 built the enum, the transition guard, the
confidence arithmetic and the forensic log, but nothing drives them - the
daemon never leaves Active, so six of eight states are unreachable outside
tests, and no sensor feeder exists. Notes the two places the code already
diverges from section 4.
25 captures the pipeline unification: souveraine's CI is the only one
doing repo-add --sign, so everything else has to be hand-carried to the
phone. Records the phone-side wiring that went live today and the two
pacman traps behind it (DownloadUser vs a custom XferCommand, and the
DisableSandbox* lines that were never real options).
