PAF becomes saf/device (history kept), STATE.md dissolves
into saf/state.md with the dated era archived, the substrate
SAF moves up from souveraine, and every agreement points at
saf/INDEX.md and nowhere else. one map, nothing to remember
Device page renders state, evidence, per-source health, sensors_degraded and the
decision trail. Notes what is still absent from device_state: last-seen per
source, and grip as a fourth source.
TASK-39 step 1 is done and clean — default-routes stores 0.49 cubed and
rewrites within 6s of a change. 'Pinned on boot' is a faithful restore
of a value lower than wanted, so this is defaults and roles. No second
writer.
TASK-19 gains Casey's ask: source health, evidence and confidence have
no surface anywhere. Readout now, controls after 08(g) decides.
Both were sub-items, not work units. 01's every step read "after 16.B/C";
22 sourced its own candidates from 19's still-required list and its status
line was "enumerate with Casey at session start".
Records what the 2026-07-21/22 sessions actually found and shipped,
so the ledger matches reality:
- TASK-16: A, B, D landed; C (contact card) implemented, phone
acceptance pending; new unit E (history-fill boot amnesia) done.
- TASK-08: shell-side state projection exists; add the maintenance-
lease requirement so a deploy can never race the idle lock again
(root cause of the 19:29 auto-lock-during-deploy crash).
- TASK-09: stale-lock incident — panel/IRQ alive, session-lock
routing stale; capture both in the resume test.
- TASK-14: expand to the Auxo-style running-app surface and an
unconditional Home tap; folds in the GLES OpacityMask and
workspace-ratchet findings.
- TASK-17: pin the iOS-like keyboard target and the Hyprland
key-safety hammer test.
- Mic trace path corrected to its new home.
New: TASK-19 (settings control center), TASK-20 (player video +
agent control), TASK-21 (reboot-to-Android confirmation), TASK-22
(settings/fullscreen tweaks), TASK-23 (culver locked-notification
nudge).
