Five weeks of forge evidence per week rather than a rolling window, so a
finding survives under one key and "closed after three weeks" is computable.
Rules run deterministically; agent.py hands the packet to whoever writes the
prose and never calls a model itself.
Model choice fails closed — no default, no substitute, and the exact named
model must be served or the pass refuses to run.
Scoped from the 2026-08-17/18 revoked-token incident: a day of 401s healed only by claude code rewriting the spare. Souveraine can refresh, rotate, and adopt logins but cannot birth one — so it mint its own PKCE grant, outside the phone/laptop sync, and say so in the Panel when every login is dead. Full Providers subsection is a later expansion.
3431223 supplies tiled edges and closes the 504-of-540 draw; 41f07b1 removes 3,034 false touch-frame warnings.\n\nBoth are on ViewTop main. Package and glass proof remain separate.
Twelve completed or superseded task records leave the live queue; the byte-identical rename duplicate is removed.\n\nThe authority and somatic source records now point at SAF, while tasks 33, 48, 49, 53, 60, and 76 say what is actually left.
Folder/subcategory support and inbox capture landed in souveraine-lens (61cf534, c71c7e4); this files the owner doc the build was missing and indexes it.
Five souveraine files own no package across the two live devices, and
/etc/systemd/system/souveraine-machined.service shadows the packaged
signer unit on both — measured, not inferred. Retires the Phase C deploy
checklist: CLAUDE.md banned its build step on 2026-07-24, START-HERE §5
bans its deploy step.
The config hands the subconscious sliding_window where the doc and the
code default both say sliding_reflect, and the memory tool exposed the
blind strategy while hiding the safe one.
Also indexes 63, 64 and 66 — all three existed on disk and in no table.
Measured once: reply commits and PrimaryComplete fires, then the N+1
pass stops at round 3 of 10 with a fully idle runtime. The pass runs
inside run_turn, so tx never drops and the SSE stream never closes.
Lead is the todo tool. Stream lifetime is a separate fix.
STATE.md was five days stale. It now carries what is on the phone
(viewtop r76, souveraine r333) and the four defects fixed on the glass:
per-window capture was unreachable because quickshell holds wlr handles and
the ext capture source is named by an ext handle with nothing correlating
them; titles were never republished on commit; the border was a filled slab
that relied on the client covering its middle; capture came back flipped.
Also the packaging hole, which was the important one — viewtop's PKGBUILD
existed and appeared in none of packages.yml's build lists, so nothing ever
built it. Half closed: it builds now, but a viewtop commit still does not
trigger a rebuild.
TASK-15 question 1 is answered and closed: dropping the accelerometer claim
took iio-sensor-proxy from 15.3% to 1.1%, sensors overall 17.2% to 2.6% of
a core. Consequence noted against 08(g) — confidence loses accel's +0.3.
New: 54, 55, 56, and 57/58 (Pi dock head, SMB2 OTG boost) with the USB
notes they point at.
Nine findings from an adversarial read of the night's work, ranked.
Six others from the same audit are already fixed; these are the rest.
The method note is the part worth keeping: every one of these passed
all four gates. A wedged compositor reports shell=active with zero
errors, so green proves nothing about behaviour.
52 maps the fifteen-technique attention vocabulary onto what viewtop can
actually do. Two are already landed — expose IS negative space, pose IS
gravity wells — and compile_custom_pixel_shader + PixelShaderElement are
already in our smithay, so #1/#6/#9/#11/#12/#13/#14 need no new machinery.
The load-bearing note is ordering: build the attention model and one
global clock before any individual effect, or fifteen animators fight
over the same surfaces and it is §1's blind actors in the render path.
That failure already happened this week in the panel. Attention decisions
go in forensic.jsonl in the same change, so the atmosphere is
imperceptible in the moment and legible afterward — the standard every
other authority here is held to.
45: the PMIC haptics path accepts and plays an FF effect and the CS40L20
is absent from this kernel, so the five-minute check is now one question
only a hand can answer.
The gaps were prose in TASK-43 and a summary message. They are tasks now.
50 is the one that matters: every scene intent dispatches except touch, so
she can move and dim a window and cannot press anything in one — and the
workaround is the uinput bridge, which launders her intent into a physical
touch inside the kernel where nothing can undo it. That is the conflation
input.rs was written to prevent, and it is live every day this stays open.
51 is the punch list found by using the phone rather than reading it:
stacked windows, capture written-and-unmerged so nothing visual can be
verified, volume recognised and dropped, and the named holes.
Device page renders state, evidence, per-source health, sensors_degraded and the
decision trail. Notes what is still absent from device_state: last-seen per
source, and grip as a fourth source.
Re-measured by md5 across both devices. The ii-base pin + ii-phone overlay
landed without this task being worked and killed the drift: laptop-only is 0,
the settings suite is byte-identical everywhere, and the 4 phone-only files
are the declared overlay.
Six stranded files remain. Also corrects two claims in the 07-21 record: the
phone-only KEEP list names three files that no longer exist anywhere, and
deploy.sh no longer 'only rsyncs surfaces/' - it rsyncs the pin with --delete,
which is why an undeclared phone-local file cannot survive.
deploy.sh:246 rsyncs --delete into the phone's surface tree with no snapshot,
unlike the local compose which snapshots to .ii-previous. Root cause is
installing into $HOME, which has no file-ownership model. Payload belongs in
/usr/share owned by a package; $HOME keeps only overrides.
13 (grip) and 35 (sessiond deadlock) are done; both moved to archive/ with
closing notes. Index regrouped by state with a one-line what's-left per task
instead of a flat table of history; the archive prose moved to archive/README.
Corrected stale statuses: 29 shipped (read-only pending polkit), 31's component
and squeeze are live and only its contents are open, 42's layer 1 is built, 34
no longer blocks grip, 43 was numbered 42.
New: 44 fingerprint (DT + shim sat unused in staging/ since 07-07), 45 haptics
(settle which chip drives the motor before porting cs40l2x), 46 camera (drivers
and CAMSS are already in-tree; blueline's DT has no camera node).
A rotted action pin skipped the publish job rather than failing it, so
edge stopped publishing and the phone sat on an old build for a working
day with nothing saying why. The runner journal logs task pickup and
never outcome, which is what was being read.
ci-status.sh asks Gitea instead, drilling run -> job -> log tail on a
failure. claude-hook-push-ci.sh runs it after every git push so the
answer arrives without anyone choosing to look. TASK-42 has the
three-layer plan; this is layer 1.
Foundation landed: lock handoff, admission gate, layer stack, back verb,
intent table. 123 tests, CI green for the first time (repo was never
fmt-clean). No Wayland/DRM yet.
Records the two traps: the lock handoff is the normal path, and sessiond
is already the availability layer so the compositor gets no fallback
presenter.
TASK-39 step 1 is done and clean — default-routes stores 0.49 cubed and
rewrites within 6s of a change. 'Pinned on boot' is a faithful restore
of a value lower than wanted, so this is defaults and roles. No second
writer.
TASK-19 gains Casey's ask: source health, evidence and confidence have
no surface anywhere. Readout now, controls after 08(g) decides.
07-27's 'ignores force' conclusion is superseded — same binary, no
nanoapp, 2502-2990 deflection. Kept verbatim below the correction.
The nanoapp is off grip's critical path but still wanted for doze,
the real detector, haptics and TASK-40.
Our engine pins are already theirs. The embedder, the eleven-patch
DMSAA/external-texture series, KMS and the GBM atlas path are the
expensive parts and they are readable.
Their lock is a compositor-internal bool with PAM dlopened in-process
and no ext-session-lock served at all. It is invisible to logind and
sessiond, and it gates input against every caller including Annie.
viewtop serves the protocol; sessiond keeps the decision.
Also adds TASK-41 (attested producers), raised out of grip bring-up.
