6a86b510b5
Four docs recorded 'nothing starts it' as settled fact and concluded don't use the target, where the conclusion available was light the target. viewtop's session launcher starts it now.
159 lines
8.2 KiB
Markdown
159 lines
8.2 KiB
Markdown
# DUMP · task-doc duplication + state-machine findings — 2026-08-14
|
||
|
||
Handoff. Nothing here is pushed. One commit exists locally and is described in §1.
|
||
|
||
---
|
||
|
||
## 1. Landed locally, NOT pushed
|
||
|
||
`souveraine` `primary` is **ahead 1**: `c31fa10 stop expecting the accelerometer nothing reports`.
|
||
|
||
`EXPECTED_SOURCES` still listed `Accelerometer` after `6b67512` (08-04) unclaimed
|
||
it for 14% of a core. So `SOURCE_EXPECTED_WITHIN` (300 s) elapsed every boot,
|
||
accel went `Absent`, `any_down()` counts `Absent`, and **`sensors_degraded` read
|
||
true on 3074 consecutive snapshots** in the current trail file alone — TASK-19's
|
||
Device page banner has been lit for ten days over a sensor that was deliberately
|
||
removed. The const's own doc comment forbids exactly this.
|
||
|
||
Gates, on archdev, `cargo test --features sessiond --bin souveraine-sessiond`:
|
||
126 pass. Reintroduce the bug and exactly two fail (`left: Absent right: Unknown`,
|
||
`left: 3 right: 2`), so the gate is proven able to fail. Clippy: 30 errors, and
|
||
**the same 30 with and without the change** — all pre-existing.
|
||
|
||
**The push is an open decision.** It publishes into `edge`, which today carries
|
||
the poisoned r498. The publish would supersede it and unblock `pacman -Syu` — but
|
||
it carries `3670b88` and `1ef8a20` along, both of which AUDIT §6 marks *not
|
||
exercised*.
|
||
|
||
## 2. The pocket veto's only measured effect is refusing Casey
|
||
|
||
Measured across all three trail generations (~10 MB):
|
||
|
||
- **17** `input-refused` entries total. **17/17 are `DoubleTapToWake`.** No other
|
||
trigger has ever been refused.
|
||
- All 17 are **one burst**: ts 1786671941, 943, 945, 945, 946, 946, 947, 947,
|
||
948, 948, 948, 949, 949, 950, 950, 951, 951 — 17 refusals in 10 seconds,
|
||
accelerating from one per 2 s to two per second.
|
||
- Snapshot at refusal: `belief=pocket confidence=0.70 covered=true locked=true
|
||
lit=false active=false`, `proximity_near=true`.
|
||
|
||
That is Casey at a dark screen tapping harder because nothing happened. The veto
|
||
has **never refused an actual pocket**. True positives: zero.
|
||
|
||
Casey's mechanism, 2026-08-14: *"if I double tap 3 or 4 times in a quick
|
||
succession that's the whole belief should shift a bit."* A pocket does not emit
|
||
escalating deliberate double-taps, and the FTS controller recognises DBLTAP
|
||
specifically (`PAF/touch.md`), not arbitrary contact — so a burst of them is
|
||
intent by construction.
|
||
|
||
`suppress_wake` (`device_state.rs:2795`) is a pure function of `placement()` with
|
||
no memory. `note_input_gated` (`:2372`) already records every refusal through
|
||
`record_decision` — the evidence is being written and nothing reads it back.
|
||
|
||
Numbers come off the trail per §9.5: the burst opens at +2 s and tightens to
|
||
2/s, so ~3 attempts inside ~5 s sits above anything a pocket produces and below
|
||
what Casey reached in under six seconds. Fail open, and say so in the trail.
|
||
|
||
## 3. The documented test gate never compiles sessiond
|
||
|
||
`CLAUDE.md` documents `cargo build` / `cargo test`. `souveraine-sessiond` is
|
||
`required-features = ["sessiond"]`, so a plain `cargo test` never builds
|
||
`src/sessiond/` at all.
|
||
|
||
cargo test -> 389 + 10 + 8, zero sessiond
|
||
cargo test --features sessiond --bin souveraine-sessiond -> 126 tests
|
||
|
||
`device_state.rs` — 5300 lines, the state machine, `LEGAL_TRANSITIONS`, the
|
||
confidence arithmetic, source health, the forensic chain, bearer — has 126 tests
|
||
the documented command has never once run. Every "389 tests pass" in
|
||
`AUDIT-2026-08-14.md` was a suite that did not compile the daemon being changed.
|
||
Same for clippy: 30 errors under `--features sessiond --all-targets`, invisible
|
||
to the documented gate.
|
||
|
||
## 4. souveraine/docs/tasks/ is eight dead copies and an index
|
||
|
||
`SouveraineOS/docs/tasks/archive/from-substrate/README.md` already did this work
|
||
properly — 18 files, each with its new owner named. The originals were never
|
||
removed, and have since been **committed to git**, so they now read as
|
||
authoritative.
|
||
|
||
**Six are byte-identical to their archived twins** (`cmp -s`, all six):
|
||
`power-indication.md`, `quickshell-surface-package.md`,
|
||
`device-specific-quickshell-profiles.md`, `souveraine-cicd-pipeline.md`,
|
||
`souveraine-lock-primitives.md`, `souveraine-lock-primitives-session-prompt.md`.
|
||
|
||
Two were promoted and renamed rather than archived:
|
||
`souveraine-native-audio-privacy.md` → `docs/AUDIO-PRIVACY.md`,
|
||
`souveraine-settings-ipc-profiles.md` → `docs/SETTINGS-AUTHORITY.md`.
|
||
|
||
The ninth is `INDEX.md`, byte-identical to `docs/substrate/tasks/INDEX.md` except
|
||
for **nine lines** — seven of which are the STALE banner ("generated 2026-05-19,
|
||
describes May") that only the substrate copy carries. The copy in the repo people
|
||
open is the one with the warning missing.
|
||
|
||
### The two that actively misdirect
|
||
|
||
**Audio.** `souveraine-native-audio-privacy.md` and `AUDIO-PRIVACY.md` carry the
|
||
**same `task_id: souveraine-native-audio-001`** and opposite architectures. The
|
||
souveraine copy: *"Native PulseAudio is the only audio server… `pipewire-pulse`
|
||
is never started."* AUDIT-updated `AUDIO-PRIVACY.md` (08-07): *"PipeWire 1.6.8
|
||
owns the graph… Native PulseAudio and the old ABI-provider shims are historical
|
||
experiments, not the desired architecture."* TASK-39 names
|
||
`pipewire-abi-provider` — which the souveraine copy is built on — as the retired
|
||
experiment that *"must not drive current policy."* Both files are
|
||
`status: in_progress`, `priority: high`.
|
||
|
||
**Power.** `power-indication.md` specifies `services/PowerService.qml`: a QML
|
||
singleton reading UPower and driving idle policy through `IdleCoordinator`.
|
||
`DEVICE-STATE-MACHINE.md` §12 forbids that exact shape and predicts an outside
|
||
adviser will propose it. TASK-33: *"Do not add a fourth surface that reads UPower
|
||
directly. That is the problem."* Its work-breakdown items 1–5 also describe
|
||
upower-fork work TASK-08(b) records as landed three weeks ago across four
|
||
commits (`628283f`, `718e921`, `f974714`, `beb94dc`).
|
||
|
||
### Also unindexed
|
||
|
||
Four files on disk in `docs/tasks/` and absent from `README.md`: **49, 54, 61,
|
||
72**. All four hold landed code or measured hardware. TASK-49 is the sharp one:
|
||
`SouveraineOS/CLAUDE.md` states it *"was written about packaging that
|
||
TASK-25/29/32 already owned, and had to be deleted."* It was not deleted, and it
|
||
is bearer/DNS/VPN, not packaging — with a landed `src/sessiond/bearer.rs` section
|
||
and acceptance #3–#5 still open.
|
||
|
||
## 5. Everything that does NOT go through the state machine
|
||
|
||
`SensorSource` is closed at `{ Proximity, Accelerometer, Light, Touch }`;
|
||
`SensorValue` is four booleans. So:
|
||
|
||
| Wanted | State of it |
|
||
|---|---|
|
||
| charge/battery | no variant. TASK-33's "last raw feed going straight to the glass", confirmed |
|
||
| thermal | no variant. TASK-08(h): 23 zones, nothing below 85 °C, policy empty |
|
||
| grip | no variant. TASK-19: "why didn't my squeeze work" has no answer on the device |
|
||
| lux | flattened to `Changing(bool)` — a change-detector cannot drive brightness |
|
||
| brightness `Action` | absent from the `Action` enum. TASK-47: "`grep anchor src/` is empty" |
|
||
| last-seen per source | `EvidenceSeen` holds it internally, never crosses IPC |
|
||
|
||
## 6. Live risks found today, not addressed
|
||
|
||
- **`kitty-touch-bridge`** — unpackaged overlay service on the daily driver
|
||
holding a global uinput pointer when it fires. Claims to fail closed outside
|
||
Kitty; unverified. START-HERE trap #5, §12's blind actor, and TASK-50 already
|
||
says the agent *"still reaches touch through uinput, which is the exact
|
||
conflation `input.rs` exists to prevent"* — so this is a second one.
|
||
- **archdev mirror pollution.** `/home/casey/Projects/souveraine/` has a
|
||
flattened `src` tree at its **root** — `main.rs`, `core/`, `server/`,
|
||
`bridge/`, `bin/`, `api/` beside the real `src/`. `main.rs` there is dated
|
||
08-05, so it predates this session. Left alone; deleting at the mirror root is
|
||
Casey's call.
|
||
- **`libssc.so.2`** now malformed alongside `libcmatrix.so.0u`. TASK-25 logs the
|
||
latter as the ldconfig warning on every transaction. There are two now.
|
||
|
||
## 7. Task queue as filed
|
||
|
||
1 fixed. 2 docs. 3 charge→machine. 4 lux enum. 5 brightness Action (blocked on 4).
|
||
6 grip. 7 last-seen. 8 kitty-touch-bridge. 9 tap-repetition belief shift.
|
||
10 the sessiond gate.
|
||
|
||
**If only one thing gets done: §2.** It is measured, it is small, and it is the
|
||
one where the phone currently refuses its owner.
|