SouveraineOS/docs/DUMP-taskdocs-2026-08-14.md

DUMP · task-doc duplication + state-machine findings — 2026-08-14

Handoff. Nothing here is pushed. One commit exists locally and is described in §1.

---

1. Landed locally, NOT pushed

souveraine primary is ahead 1: c31fa10 stop expecting the accelerometer nothing reports.

EXPECTED_SOURCES still listed Accelerometer after 6b67512 (08-04) unclaimed it for 14% of a core. So SOURCE_EXPECTED_WITHIN (300 s) elapsed every boot, accel went Absent, any_down() counts Absent, and sensors_degraded read true on 3074 consecutive snapshots in the current trail file alone — TASK-19's Device page banner has been lit for ten days over a sensor that was deliberately removed. The const's own doc comment forbids exactly this.

Gates, on archdev, cargo test --features sessiond --bin souveraine-sessiond: 126 pass. Reintroduce the bug and exactly two fail (left: Absent right: Unknown, left: 3 right: 2), so the gate is proven able to fail. Clippy: 30 errors, and the same 30 with and without the change — all pre-existing.

The push is an open decision. It publishes into edge, which today carries the poisoned r498. The publish would supersede it and unblock pacman -Syu — but it carries 3670b88 and 1ef8a20 along, both of which AUDIT §6 marks not exercised.

2. The pocket veto's only measured effect is refusing Casey

Measured across all three trail generations (~10 MB):

• 17 input-refused entries total. 17/17 are DoubleTapToWake. No other trigger has ever been refused.
• All 17 are one burst: ts 1786671941, 943, 945, 945, 946, 946, 947, 947, 948, 948, 948, 949, 949, 950, 950, 951, 951 — 17 refusals in 10 seconds, accelerating from one per 2 s to two per second.
• Snapshot at refusal: belief=pocket confidence=0.70 covered=true locked=true lit=false active=false, proximity_near=true.

That is Casey at a dark screen tapping harder because nothing happened. The veto has never refused an actual pocket. True positives: zero.

Casey's mechanism, 2026-08-14: "if I double tap 3 or 4 times in a quick succession that's the whole belief should shift a bit." A pocket does not emit escalating deliberate double-taps, and the FTS controller recognises DBLTAP specifically (PAF/touch.md), not arbitrary contact — so a burst of them is intent by construction.

suppress_wake (device_state.rs:2795) is a pure function of placement() with no memory. note_input_gated (:2372) already records every refusal through record_decision — the evidence is being written and nothing reads it back.

Numbers come off the trail per §9.5: the burst opens at +2 s and tightens to 2/s, so ~3 attempts inside ~5 s sits above anything a pocket produces and below what Casey reached in under six seconds. Fail open, and say so in the trail.

3. The documented test gate never compiles sessiond

CLAUDE.md documents cargo build / cargo test. souveraine-sessiond is required-features = ["sessiond"], so a plain cargo test never builds src/sessiond/ at all.

cargo test                                                -> 389 + 10 + 8, zero sessiond
cargo test --features sessiond --bin souveraine-sessiond  -> 126 tests

device_state.rs — 5300 lines, the state machine, LEGAL_TRANSITIONS, the confidence arithmetic, source health, the forensic chain, bearer — has 126 tests the documented command has never once run. Every "389 tests pass" in AUDIT-2026-08-14.md was a suite that did not compile the daemon being changed. Same for clippy: 30 errors under --features sessiond --all-targets, invisible to the documented gate.

4. souveraine/docs/tasks/ is eight dead copies and an index

SouveraineOS/docs/tasks/archive/from-substrate/README.md already did this work properly — 18 files, each with its new owner named. The originals were never removed, and have since been committed to git, so they now read as authoritative.

Six are byte-identical to their archived twins (cmp -s, all six): power-indication.md, quickshell-surface-package.md, device-specific-quickshell-profiles.md, souveraine-cicd-pipeline.md, souveraine-lock-primitives.md, souveraine-lock-primitives-session-prompt.md.

Two were promoted and renamed rather than archived: souveraine-native-audio-privacy.md → docs/AUDIO-PRIVACY.md, souveraine-settings-ipc-profiles.md → docs/SETTINGS-AUTHORITY.md.

The ninth is INDEX.md, byte-identical to docs/substrate/tasks/INDEX.md except for nine lines — seven of which are the STALE banner ("generated 2026-05-19, describes May") that only the substrate copy carries. The copy in the repo people open is the one with the warning missing.

The two that actively misdirect

Audio. souveraine-native-audio-privacy.md and AUDIO-PRIVACY.md carry the same task_id: souveraine-native-audio-001 and opposite architectures. The souveraine copy: "Native PulseAudio is the only audio server… pipewire-pulse is never started." AUDIT-updated AUDIO-PRIVACY.md (08-07): "PipeWire 1.6.8 owns the graph… Native PulseAudio and the old ABI-provider shims are historical experiments, not the desired architecture." TASK-39 names pipewire-abi-provider — which the souveraine copy is built on — as the retired experiment that "must not drive current policy." Both files are status: in_progress, priority: high.

Power. power-indication.md specifies services/PowerService.qml: a QML singleton reading UPower and driving idle policy through IdleCoordinator. DEVICE-STATE-MACHINE.md §12 forbids that exact shape and predicts an outside adviser will propose it. TASK-33: "Do not add a fourth surface that reads UPower directly. That is the problem." Its work-breakdown items 1–5 also describe upower-fork work TASK-08(b) records as landed three weeks ago across four commits (628283f, 718e921, f974714, beb94dc).

Also unindexed

Four files on disk in docs/tasks/ and absent from README.md: 49, 54, 61, 72. All four hold landed code or measured hardware. TASK-49 is the sharp one: SouveraineOS/CLAUDE.md states it "was written about packaging that TASK-25/29/32 already owned, and had to be deleted." It was not deleted, and it is bearer/DNS/VPN, not packaging — with a landed src/sessiond/bearer.rs section and acceptance #3–#5 still open.

5. Everything that does NOT go through the state machine

SensorSource is closed at { Proximity, Accelerometer, Light, Touch }; SensorValue is four booleans. So:

Wanted	State of it
charge/battery	no variant. TASK-33's "last raw feed going straight to the glass", confirmed
thermal	no variant. TASK-08(h): 23 zones, nothing below 85 °C, policy empty
grip	no variant. TASK-19: "why didn't my squeeze work" has no answer on the device
lux	flattened to Changing(bool) — a change-detector cannot drive brightness
brightness Action	absent from the Action enum. TASK-47: "grep anchor src/ is empty"
last-seen per source	EvidenceSeen holds it internally, never crosses IPC

6. Live risks found today, not addressed

• kitty-touch-bridge — unpackaged overlay service on the daily driver holding a global uinput pointer when it fires. Claims to fail closed outside Kitty; unverified. START-HERE trap #5, §12's blind actor, and TASK-50 already says the agent "still reaches touch through uinput, which is the exact conflation input.rs exists to prevent" — so this is a second one.
• archdev mirror pollution. /home/casey/Projects/souveraine/ has a flattened src tree at its root — main.rs, core/, server/, bridge/, bin/, api/ beside the real src/. main.rs there is dated 08-05, so it predates this session. Left alone; deleting at the mirror root is Casey's call.
• libssc.so.2 now malformed alongside libcmatrix.so.0u. TASK-25 logs the latter as the ldconfig warning on every transaction. There are two now.

7. Task queue as filed

1 fixed. 2 docs. 3 charge→machine. 4 lux enum. 5 brightness Action (blocked on 4). 6 grip. 7 last-seen. 8 kitty-touch-bridge. 9 tap-repetition belief shift. 10 the sessiond gate.

If only one thing gets done: §2. It is measured, it is small, and it is the one where the phone currently refuses its owner.