STATE.md was five days stale. It now carries what is on the phone
(viewtop r76, souveraine r333) and the four defects fixed on the glass:
per-window capture was unreachable because quickshell holds wlr handles and
the ext capture source is named by an ext handle with nothing correlating
them; titles were never republished on commit; the border was a filled slab
that relied on the client covering its middle; capture came back flipped.
Also the packaging hole, which was the important one — viewtop's PKGBUILD
existed and appeared in none of packages.yml's build lists, so nothing ever
built it. Half closed: it builds now, but a viewtop commit still does not
trigger a rebuild.
TASK-15 question 1 is answered and closed: dropping the accelerometer claim
took iio-sensor-proxy from 15.3% to 1.1%, sensors overall 17.2% to 2.6% of
a core. Consequence noted against 08(g) — confidence loses accel's +0.3.
New: 54, 55, 56, and 57/58 (Pi dock head, SMB2 OTG boost) with the USB
notes they point at.
toggle_float was the only caller-visible un-float and it went with the
three-finger binding when that became a sessiond verb. Recorded rather
than left as dead code with a comment.
Nine findings from an adversarial read of the night's work, ranked.
Six others from the same audit are already fixed; these are the rest.
The method note is the part worth keeping: every one of these passed
all four gates. A wedged compositor reports shell=active with zero
errors, so green proves nothing about behaviour.
Three fingers should raise an overlay with move/resize/close and the
scaled, sliding visuals the reference shell has. Reading how that shell
does it: its compositor publishes a texture_id AND full geometry per
window on the wire, and the shell draws that texture wherever and at
whatever scale it likes. That is the whole trick behind scaled cards and
every sliding transition.
Ours cannot. The registry publishes size and deliberately never
position, and the only capture source served is per-output rather than
per-toplevel. So the overlay is two pieces of plumbing in order: publish
position alongside size, then a foreign-toplevel capture source.
Building the overlay in the compositor instead would be quicker and
wrong — it is UI, and it would be the one piece of chrome the agent
could not restyle.
START-HERE §6 said the phone has no wifi away from home because the
SSIDs are pinned. It joined a foreign SSID on 2026-08-02 and sat there
working while that paragraph sent the reader hunting for a cable. It
now says how to pass the address, and records that a phone off the home
net reaches the repo through the laptop rather than by bringing the
phone's tunnel up.
TASK-51 §3 said the volume buttons do nothing. They were wired on
2026-08-02 in 266af98 — Action::Volume on the down edge, through the
executor table, with tests. Only the gesture level is still unbound.
SECURITY-AUDIT gains three rows its own review cadence required: the
virtual-keyboard and input-method bind filters admit every client, which
is keystroke injection and observation from any uid-1000 process
(verified live with wtype); the clipboard gate is written and tested and
routed at no call site; xdg-activation accepts every token and never
prunes them.
Five protocol filters admit every client, two of them keystroke paths.
A wake leaves no trail entry. The device flaps Locked/Observed with no
hysteresis. Four behaviours recognised and bound to nothing. Three
shipping paths that silently do not ship.
Doctrine explains why the system is shaped the way it is and is the wrong
thing to open when the screen is black. This is for that: USB
unreachability (with the ARP test that proves the phone is fine), the
black-screen regression and its mechanism, what to do when a Hyprland
binding stops existing, where to build, the three different ways things
reach the phone and why an overlay-only fix never arrives, and the five
traps that have each cost a session.
Every repo's CLAUDE.md now points here before it points at doctrine.
52 maps the fifteen-technique attention vocabulary onto what viewtop can
actually do. Two are already landed — expose IS negative space, pose IS
gravity wells — and compile_custom_pixel_shader + PixelShaderElement are
already in our smithay, so #1/#6/#9/#11/#12/#13/#14 need no new machinery.
The load-bearing note is ordering: build the attention model and one
global clock before any individual effect, or fifteen animators fight
over the same surfaces and it is §1's blind actors in the render path.
That failure already happened this week in the panel. Attention decisions
go in forensic.jsonl in the same change, so the atmosphere is
imperceptible in the moment and legible afterward — the standard every
other authority here is held to.
45: the PMIC haptics path accepts and plays an FF effect and the CS40L20
is absent from this kernel, so the five-minute check is now one question
only a hand can answer.
The gaps were prose in TASK-43 and a summary message. They are tasks now.
50 is the one that matters: every scene intent dispatches except touch, so
she can move and dim a window and cannot press anything in one — and the
workaround is the uinput bridge, which launders her intent into a physical
touch inside the kernel where nothing can undo it. That is the conflation
input.rs was written to prevent, and it is live every day this stays open.
51 is the punch list found by using the phone rather than reading it:
stacked windows, capture written-and-unmerged so nothing visual can be
verified, volume recognised and dropped, and the named holes.
The panel had no way back: apply_gesture answers a tap on a dark panel
with Restore, which is brightness, and there was no unblank in the action
table. Invisible while hyprland bound the keys straight to the toggle;
under viewtop it became a phone that could sleep and never wake.
Records the wake loop too, because building it wrong is the obvious move:
viewtop waking directly worked, then sessiond resolved the same press,
found the panel lit, and blanked it again. One press woke the phone and
put it back to sleep. Plus why dt2w is a wake and not a button, and the
deploy order that has to hold between the two halves.
All four faults were consequences of reporting the hint from the shell.
viewtop reports it instead: it is in the seat's session, SendLocked is the
moment the locked event goes out, and it can publish a level rather than
an edge so a cleared hint corrects itself.
Records the hardware result — lock-before-blank, lock-directive,
transition locked=True, panel-off locked=True, and no blank-without-lock.
Three independent faults, any one enough: greetd ran the desktop in its
greeter slot so logind refused SetLockedHint outright; the hint was
written to the caller's session and read from User.Display, which an ssh
login redirects; and the one report that mattered was swallowed by a
guard that never replayed it. Every blank went out unlocked and recorded
blank-without-lock.
Also records the check that catches it in one line, and why verifying the
actuator directly proves nothing about the ordering.
greetd launches it, Hyprland does not run, the shell's whole surface tree
composites on it. Points at the session record in the viewtop repo rather
than restating it here.
Steps 1-2 of the build order are done and step 3 is half done; the live
gap list lives with the code.
viewtop at 458a354. Records the touch fork (provenance from the event
source; the agent reaches the seat but never the evidence stream) and
marks lanes 1 and 2 done — the Smithay frontend and the session-lock
server both landed.
Adds the resume steps for KMS on device: what it will actually show
(clients on black — shell-host is still thirteen lines), the cheap proof
that needs no pixels (sensor_health.touch is `unknown` on the phone and
has never been anything else), the missing test client, and the DRM
master risk on a daily driver.
Also: the `vanguard` ssh entry on the phone has the wrong user, which
presents as a key failure.
souveraine-callaudiod routes ENABLE_SPEAKER through the hook, which writes the
amps directly instead of switching a sink port that cannot exist on this card.
Verified over D-Bus: enable -> both amps, disable -> earpiece, not headset.
A real call is the outstanding confirmation.
HiFi captures fine - 204136 nonzero, peak 32726 - once the channel map is
clean. The zeros were stale SLIM map state, which PAF/audio.md already
documents as the alternation law and the post-call unmapped-leg bug, and the
TX7 poke used to "test the decimator" recreated that bug on all three AIFs.
Device is back on HiFi; the Voice Call workaround is reverted.
None reached blueline. The new measurement rules out the decimator and the
front-end mixer, which favours the sysclk/SLIM-lifecycle direction of mic-fix
over the pad-configuration branches.
gnome-calls asks org.mobian_project.CallAudio, which callaudiod owns, and
callaudiod switches a sink port - which cannot work when ACP splits earpiece and
speaker across two profiles. The working toggle is the hook's speaker on|off and
nothing in the UI calls it. Fix is a shim that claims the name; it needs a real
call to test before enabling.
92133 frames at peak 0. Codec routing is correct and forcing the call profile's
TX7 decimator changes nothing, so it is neither the decimator nor the front end
- what is left in the 11-control diff is VoiceMMode1. Voice Call (Mic, Speaker)
gives working mic plus speakerphone and is the workaround. Capture gain is UCM's
to set; runtime amixer does not survive profile activation.
The card was stuck in the modem call profile, so audio came out of the earpiece
and read as a weak speaker. Restoring HiFi is manual; classifying when each
profile is wanted is the actual task. Also notes that the device runs pipewire
while pipewire-abi-provider claims PulseAudio owns the stack.
KEY_WAKEUP lands on event4 at the same timestamp as the hardware edge, so the
existing XF86WakeUp bind can already see it. arm generates its own edge, which
means re-arm-on-interrupt feeds itself - that was the 1444 events, not the
sensor. wakeup_enable takes enable/disable, not 1.
fpctzappfingerprint loads from cold boot and answers; init/idle/arm all 0x0.
gpio121 goes idle-low after the sequence - the latch that killed piece 1 is
cleared, so a rising edge is possible for the first time. init accounts for 68
of the edges; armed and untouched is a flat 0 over 15s, so the 1444-event run
was the re-arm loop. Open: whether a finger raises an edge.
Reconcile the file with the code it now contradicts (the sysfs is shipped on
purpose) and register arbitrary signed-TA loading as a new Tier-0 primitive.
home_ssids needs a list: Samaritan Solutions and TheTholianWeb both lease from
10.10.20/24 (.234 and .245). Three defects only hardware showed: reapply clat
wipes the CLAT daemon's routes including the MMS /32; the gsm connection is the
wrong lever because the v4 carrier default comes from the clat tun at 2048; and
wg show needs CAP_NET_ADMIN that a user unit will never have.
wiuf was ipv4.addresses 10.8.0.5/24, which is wiufarch's; wiufph is 10.8.0.6,
the phone's. Not near-copies - bringing wiuf up would have put two devices on
one WireGuard address. wiufph also carried the dns-priority 10 fix; wiuf was
still at 0. Deleted, backed up to /root/nm-profile-backup/ on the device.
autoconnect=no left alone on purpose: it is why the tunnel does not return
after a reboot, and the switch is the user's authority per this task's own
constraints.
bearer.rs plus PreferLink/PinTunnelUnderlay and a bearer verb. Decision layer
tested (settling window, no re-emit, dead network); nothing has run on the
phone. home_ssids still unset and the wiuf/wiufph duplicate still unresolved.
And the lesson that cost the front camera: camss creates all sensor->csiphy
links in the async notifier's .complete, which needs every declared subdev to
bind. One non-probing sensor leaves the working front pair registered with zero
links. Never leave a failing sensor node enabled; a rear-disabled DTB is parked
on the device for one-cp recovery.
Found still installed 2026-08-01, in no repo and no repo's history. Three
defects, all traps the state-machine version can repeat:
- driven by the NM dispatcher and a 90s timer while calling nmcli up/down,
which is itself an NM event - an actuator wired into its own sensor. 652
recycles in 90 minutes is ~7/min, a loop, not a bad interval.
- on_home_wifi() matched ' inet 10.10.' - a /16 test that reads foreign
10.10.30.x as home and drops the tunnel as redundant. The phone is on
10.10.30.213 right now, and TASK-49's own measurements were taken there.
- managed CONN=wiuf while the phone carries both wiuf and wiufph, neither
autoconnecting.
Files removed from the device; no dispatcher hook referenced them.
sdm845_domains[] carries mpss_root_pd and mpss_wlan_pd, so wifi and cellular
share the modem's PD broker on this SoC. A broker that stops serving explains
a no-attach that only a reboot clears.
The stranded mic-fix commit is not the fix: it edits arch/arm64/configs and
debian/config, and the PKGBUILD reads neither (cp config-blueline.aarch64,
olddefconfig, no merge_config.sh). Whether =m should become =y in the config
we do ship is open, and untestable until the failure is captured live.
The staged vendor driver is the fpc_fingerprint variant, which blueline does
not build (b1c1_defconfig sets CONFIG_FPR_FPC=y, the other copy). The shipping
one has an empty vreg_conf[] and manages no regulators at all.
The TZ pointer was wrong: secure_load_tz_frontier.md is superseded and covers
hyp-assign/XPU, not TA loading. tz_listener_archaeology.md plus the four
qseecom commits are the record, and they already show TZ answering us -
version query succeeds, listener 0x5000 registers live. What is missing is
app loading, not the channel.
Pins confirmed against this unit's DTBO; the FPC1075 caution is resolved.
Measured on the phone: all IPv4 left over cellular while on wifi, because NM
penalised the wifi metric +20000 for a failed connectivity check, which failed
because the VPN profile injected a resolver reachable only over the degraded
default. Prior art read off the local LineageOS image and Sailfish tree: both
route DNS per link and gate preference on a probe. We do neither.
Device page renders state, evidence, per-source health, sensors_degraded and the
decision trail. Notes what is still absent from device_state: last-seen per
source, and grip as a fourth source.
Tier 2 reached the tree on 07-30 and the glass on 07-31 — nothing mounted it in
between, and that was invisible because a component nobody instantiates logs
nothing. Notes why verifying a row means looking at the glass.
Re-measured by md5 across both devices. The ii-base pin + ii-phone overlay
landed without this task being worked and killed the drift: laptop-only is 0,
the settings suite is byte-identical everywhere, and the 4 phone-only files
are the declared overlay.
Six stranded files remain. Also corrects two claims in the 07-21 record: the
phone-only KEEP list names three files that no longer exist anywhere, and
deploy.sh no longer 'only rsyncs surfaces/' - it rsyncs the pin with --delete,
which is why an undeclared phone-local file cannot survive.
51822 not 51820; the phone has its own peer (10.8.0.6) rather than sharing
the laptop's key; keepalive 25 not 0. Records that the autonomous gate is
dead and why a full tunnel that cannot handshake takes the machine with it.
