SouveraineOS/docs/session-handoff-2026-07-16.md

Session handoff — 2026-07-16 (idle/lock/session + Chatty stack)

Casey (he/him). Souveraine = OS + agent substrate + agent. Ani + Aster = Annie.

Landed this session

libcmatrix (~/Projects/libcmatrix, branch sas-fixes) — the whole library half of the Chatty features stack, 8/8 tests pass:

• a337819 edits — CmEventRelation type, m.replace + m.new_content, cm_room_send_edit_async. In encrypted rooms the relation rides the cleartext envelope for server aggregation; m.new_content stays encrypted.
• a671822 redactions — cm_room_redact_event_async, direct PUT, optional reason.
• 8bde46c replies — inbound parse finally populates reply_to_event_id (field existed for years, nothing wrote it); cm_room_send_reply_async.
• aafcac4 reactions — inbound target+key getters (cm_event_get_reacts_to_id / get_reaction_key); outbound CmReactionEvent rides the existing message queue so encrypted rooms get normal key handling. Queue no longer assumes message events.

Touch-after-idle regression — root-caused and fixed (Pixel3Arch 73d0cd0): hypridle still issued raw hyprctl dpms after blueline-screen-toggle became the serializing DPMS authority. A double-tap wake is also input activity, so on-resume raced the XF86WakeUp wake and the FTS controller calibrated against a half-ramped panel (dmesg: "MS invalid Self Strength soft Force cal") — touch went deaf/erratic after idle. Both paths now serialize through the toggle. Rebinding the driver (echo 2-0049 > /sys/bus/i2c/drivers/fts/unbind then bind) recovers a wedged controller without reboot.

Idle manager, first real pass (souveraine b18fa33, deployed to phone):

• Dim now exists: IdleCoordinator Dimmed runs brightnessctl -s set <dimBrightness>, Active restores with -r. Previously dimRequested had NO consumer — auto-dim never existed on this stack (Android's PowerManager dim stage had no equivalent driver here).
• Native coordinator ENABLED on the phone (nativeCoordinatorEnabled: true live; repo default still false), dim 120s / lock 300s.
• Hard-won lesson: binding IdleMonitor.enabled to Idle.inhibit destroys/recreates the ext-idle-notify object during lock teardown (ii's LockScreen toggles the inhibit) → fatal Wayland "invalid object" protocol error → whole shell dies. Inhibit must be checked INSIDE the idle handlers; monitor objects must stay alive for the shell's lifetime.
• hypridle keeps its 300s lock listener as a redundant fallback until the native path has soaked; double-lock is a no-op. dpms-off (600s) and suspend (900s) remain hypridle's.

Power button = lock-then-blank (Pixel3Arch 7d1581c, deployed): XF86PowerOff → blueline-power-button: screen on → session lock IPC → wait ≤2s for compositor-acked "locked": true → blank via the DPMS authority. Screen off → wake (to lockscreen). Tap-to-wake unchanged.

In flight / not yet landed

• Chatty UI for edits/redact/reply/react — LANDED (Chatty 9425ef56 on identity-layer, builds clean on the laptop against the fork via subprojects/libcmatrix clone at sas-fixes). Long-press/right-click menu (Reply / React / Edit / Delete), inbound edit replacement + "Edited" footer, redaction tombstones, reply quoting via message subject, reaction aggregation under the bubble, reply/edit compose state in the message bar. Companion library commit libcmatrix 67d0546 (public relation getters, local-echo relation mirroring, inbound m.new_content body). NOT yet built or deployed on the phone; runtime against a live homeserver unverified.
• qtpim sqlite contacts engine — same 529 story; target ~/Projects/qtcontacts-souveraine (path 3 per contacts-design.md).
• souveraine-secrets on the phone — BUILT: ~/build/souveraine/target/release/souveraine-secrets (on-device build; laptop has no aarch64 sysroot — cross-rig is on the other machine, provisioning gap). Two blockers before it can run: (1) phone has NO ~/.souveraine/seed-id — only seed-id.pre-split-20260716 backup; daemon refuses to start seedless by design; restore-vs-regenerate is Casey's call, depends on what the seed split intended. (2) gnome-keyring currently owns org.freedesktop.secrets on the phone; mask it at switchover (homogenization doctrine anyway).

Casey's named next wants (queue for coming sessions)

1. Favorites — the original motivator. Blocked on contacts store → Person layer; Chatty identity-layer steps 1–3 already exist.
2. Lockscreen recreation — DONE 2026-07-17 (souveraine 401a660): glance-first stage with swipe-to-unlock, PIN pad slides up behind it, retreats after 25s idle. Widgets = LockSurfaceHost cards (media, agent replies). Remaining: richer glance widgets as they come up.
3. Idle manager intelligence — proximity/pocket detection ("obstructed" sensor state) gating whether the screen should ignore or accept input; settings-dependent idle profiles (charging/docked/media). Relates to the already-documented proximity-wake-bypasses-lock issue in DUMP-power-idle-lock-2026-07-15.md §2 — same sensor, same doctrine: proximity may wake the display but must never touch lock state.
4. Session-authority layer ("souveraine user") — lockscreen owned below the user shell so a shell crash can't take the lock surface with it; the power-button choreography above is the interim. Design sitting, main conversation (Aster-adjacent boundary).
5. Message events to the agent (named 2026-07-17) — two tiers: (a) push: shell takes ownership of org.freedesktop.Notifications (nothing owns it on the phone today; Chatty's im.received notifications currently evaporate) and fans out lock-card / banner / sensoria event; (b) pull: an IPC surface so an agent can be ASKED to read recent messages — likely a read-only query into Chatty's history DB or a small D-Bus iface on our fork. Tier (b) is agent-capability territory: personal-tier data, wants the capability/step-up gate (§10).
6. Agent command chaining (named 2026-07-17) — agents composing verbs across surfaces ("read the text, then draft a reply, then notify me"). Undesigned; belongs with the services-infrastructure / capability review.
7. PIL vs OSK ownership (named 2026-07-17) — when the keyboard rises, the PIL sometimes doesn't move above it; open question is who owns the follow behavior (PIL tracks OSK? compositor exclusive zones? a layout authority?). Needs a decision before more positioning band-aids.

Boot password prompt (seen post-reboot, patched live)

The "polkit didn't get password" dialog at boot was NetworkManager, not polkit: the Pixel radio times out the first 802.11 auth while settling, NM reads that as wrong-password and re-prompts via the shell agent — then the lockscreen buries the dialog. PSK was on disk the whole time. Live patches (device state, not repo): Samaritan Solutions auth-retries=4; TheTholianWeb autoconnect=no (it has NO stored secret, so autoconnect could only ever prompt). Casey also wants boot order fixed so the lockscreen loads BEFORE other shell modules — desktop must never be visible pre-lock (session-authority queue item).

Verification still owed

• Native idle path soak on phone post-reboot: dim at 2min (backlight drops, restores on touch), lock at 5min, unlock does NOT kill the shell (the fixed IdleCoordinator was deployed but the full cycle wasn't re-verified after the protocol-error fix).
• Power button end-to-end after reboot (binding loads with new hyprland.lua).
• Reboot must be a COLD boot (unplug, power off) — warm reboots poison TZ/remoteproc state on blueline.