Expose the package-owned session entry without carrying the private build and archive workflow. The public recipe continues to name Forge as its source.
Eight checks after the link: AArch64 ELF, expected loader, no embedded RPATH,
and every DT_NEEDED resolving to an aarch64 object inside the constructed
sysroot. CI builds that sysroot in runner temp from empty, so nothing survives
between runs to become part of the contract again.
It was a directory on one machine with no record of its contents, which made
the only build that can take the panel reproducible by one person. 155 arm64
packages now resolve from 12 requirements derived from the kms feature, each
verified against the archive index.
Toolchain, aarch64 target, cross linker and smithay's dependency list are
declared here instead of assumed from the build host. The phone KMS build is
named as absent and why -- it needs a target sysroot no workflow can declare.
Selection for matrix gates is an explicit enumeration; the prefix count is a
tripwire only. The pinned digest moves with it, so an un-updated copy stops
the job rather than changing what "checked" means.
Twenty commits carry internal topology in their diffs and two in their
subjects. No secrets, and the tree at HEAD is clean, so the accepted history
cannot excuse anything live.
Build and test stay; packaging, signing and archive publication do not, and
neither does the operator harness. Four references to the build host become
generic, package URLs point at the public forge, checkout is SHA-pinned.
The dependency was pinned to a host no one outside the house can reach, so a
public clone could not resolve it. Same five patches, same tree; the revision
moved because two commit identities were corrected before first publication.
Size alone is a hint to a floating toplevel. Firefox kept its CSD shadow
and drew 504 of the 540 it was told; kitty obeyed, which made it look
like Firefox's fault. Four tiled edges, unset again on place.
unplace() has always retiled and place() never did, so floating half a
split left the other half at its old rect over live dead space.
wl_touch.frame closes a group of delivered events, and most contacts on
this device never reach one — the rail, dock and pill are shell surfaces.
One warning per touch, 3034 in a session, burying the starved evidence
queue underneath them.
graphical-session{,-pre}.target are RefuseManualStart=yes, so the launcher's
start on them failed every boot from 2026-08-15: sessiond never came up, viewtop
started locked, and the panel was black. A dependency may pull a refused target
in where a direct request cannot; these two do that and nothing else.
window_local_under answers relative to the window rectangle; Window::surface_under
walks from offset (0,0) and reads its argument as relative to the buffer. Those
differ by geometry().loc — the inset a client-side-decorated app declares its
window at inside a buffer that also holds its shadow. The render already
subtracts it, so every lookup landed a shadow-width up-and-left of the finger
and Firefox had to be aimed down-and-right of anything you wanted to hit.
size is the rect the configure asked for. A client laying out against
something else keeps rendering its own, and since contacts are mapped through
the rect, the error grows with distance from the window's origin — which is
what "everywhere I tap is off, and it depends where I tap" looks like from the
outside. Nothing reported the drawn rectangle, so nothing could see it.
An on-screen keyboard has nothing to enable against when nothing is focused, so
"tapping the field does nothing" and "no surface has focus" looked identical
from outside the compositor — and no verb could tell them apart. TASK-59's rule:
what is invisible on the glass is reported.
Casey on the glass: held at weight it is a distortion to look past, "sexy IF
it's very brief". A strike is 370ms end to end on one shared envelope — rise 90,
hold 60, fall 220 — and clears any standing weight, because a pulse that left
the screen fractured behind it is not a pulse. Blink reads the same envelope.
TASK-52 #15. The dim inverted — expose and dissonance ease toward a level and
stay, this rises, holds and returns to nothing without being told to. That is
the whole technique: a presence you have to dismiss is furniture, one that
leaves on its own is weather.
Peak 0.12 so everything underneath stays readable through her; the fall is more
than twice the rise, because symmetric timings read as an element flashing. Both
chosen by eye and both said so. Absent between blinks — None rather than a zero
alpha, so the render path can skip a full-panel quad instead of compositing a
transparent one sixty times a second. Re-firing restarts; two at once would be
one blink at twice the alpha.
Not wired. The surface it drives does not exist yet: wayland.rs:186 says a
second piece of furniture arrives as a declared role on the wire and not another
app_id constant, so the veil wants a role that is full-panel, input-transparent,
and above everything but the lock. The curve is landed first because it is the
half that has to feel right, and it is the half a test can hold.
TASK-52 #6, the chromatic split. `{"intent":"dissonance","amount":0.35}` sets a
0..=1 weight — the agent composes attention and the compositor owns the mapping
to texels, so nobody outside has to track the panel's geometry. Optional angle
for the fracture's axis; it lands instantly while the amount eases, because an
axis is a direction the effect has and not a place it travels through.
atmosphere.rs owns the dial and the one settle rate, which the exposure ease now
reads too — TASK-52's whole warning is fifteen animators growing fifteen timers
and beating against each other.
The split is renderer state, not an element, so damage tracking cannot see it
move; the render path clears the buffer ages while it eases or the loop goes
idle one frame in and the fracture stops half-open. Captures are exempt: a
screenshot is a record and a record that came out fractured is unreadable.
Refuses `unavailable` when the driver would not compile the shader, rather than
accepting a look and showing nothing.
A fresh window veils in and pops to full over the same clock — the 'blur and pop' on load. Alpha eases 0→1, scale eases 0.94→1.0, ease-out over ~220ms, frame-rate independent. Obscured stays instant; a readable ghost mid-fade is a disclosure.
First brick of the one attention clock (TASK-52). expose still sets the discrete target; the compositor now eases each surface's painted alpha toward it on the vblank clock, so a dim is a curve instead of a snap. Obscured stays instant — a readable ghost mid-fade is a disclosure. Frame-rate independent, like the strip settle.
The tap was delivered twice — once to the app underneath, once (late) to the recogniser, which only commits on the last lift. The window sheet opened while the app had already eaten all three fingers. Now three fingers that arrive together cancel the client's touch and withhold the rest of the sequence, while the recogniser keeps running to resolve the tap. Two fingers still reach apps; a grab still owns its own touches.
The launcher already imported the environment, then hand-kicked three units
with reset-failed, restart and a sleep 3 — a hand-rolled PartOf and a
hand-rolled After. It starts graphical-session-pre then graphical-session now,
waits on sessiond's socket rather than a guessed 3 s, and stops both on exit.
souveraine-shell.service comes with it; it lived unowned in /etc since 07-17.
Firefox extension and Bitwarden popups were rendered above their parent but absent from client hit testing, so every contact fell through to the toplevel beneath. Walk application popups at the same origin and in the same parent-by-parent order used by rendering, including popup area outside the parent bounds.
build_planes documented a wait it never performed, so with no exportable
fence the atomic commit raced the renderer into the scan-out buffer. That is
the tearing on the d10: simpledrm has no syncobj, supports_fencing is false,
and nothing held the flip while llvmpipe was still writing.
The shell scaled real windows through pose while ZoneOverview scaled its
cards, both off one progress and running opposite curves, so the window
was at 0.6 of the glass when the card arrived near full bleed. Worse,
the pose was applied by the rail and had to be undone by whoever ended
the gesture — tapping a card never touches the rail, so a window came
back shrunk with no way to restore it.
transition.rs owns the carry: the rects are named once at begin, and
commit/cancel release. Releasing is arriving, so nothing can outlive the
gesture. Geometry reaches the glass through `carried`, read by both
window_origin and window_extent, so the render and the hit test cannot
grow terms the other lacks. focus_border yields while a window is
carried — the card draws the frame, and two frames on one rectangle was
the blue slab under the rounded card.
overview_begin/progress/commit/cancel mirror the back verbs. EndTarget
names all four destinations; LastZone is a destination rather than an
abandon branch.
A full channel dropped the subscriber, which made a fast stream
self-terminating: gaze pushes at ~25/s filled the queue faster than a QML
socket drained it, so the shell was unsubscribed inside the first burst of a
drag and never told. It looked exactly like a compositor that had stopped
pushing — and an external client that read faster kept working, which is what
made it look like the shell's bug.
Skipping the message is right for both feeds: the strip republishes on the
next change, and a contact point nobody read is stale by the time it would
have arrived.
An xdg_popup is its own surface, not a subsurface, so a layer surface's
surface tree does not contain it — and only toplevels had a popup pass. Every
menu the shell opened from the bar, the dock or the pill was created,
configured, and never composited. The dock's app-stack fan named it: tapping
a stack set `expanded`, built the arc, and put nothing on the glass.
The hit test had the same hole, one step further on: popups are not in the
layer map, so a tap on an open menu fell through to whatever was behind it.
Drawn and inert is the worse half — the surface underneath acts on a tap the
user aimed somewhere else.
Withholding every client contact during a grab took the shell's own chrome
with it, because a quickshell layer surface is a Wayland client like any
other. So "Done moving" went deaf and the move could be entered and never
left. Top and overlay layers are exempt now; the app underneath still gets
nothing, which is the point of the grab.
A release is never withheld either — the surface given the contact has to be
told it ended, or it holds a finger that is no longer on the glass.
And a three-finger tap during a move is dropped rather than stacking a second
sheet over a grab that is still live.
`scene` intent `drop` already clears a stuck grab, which is how the phone got
out of this one.
Her input region is her silhouette now, so the compositor stops handing her
contacts that land on the wallpaper — which also stopped her tracking unless
you touched her first. Where a finger is and who receives it are different
questions; this answers the first without changing the second.
Its own feed, not a field on subscribe: the strip changes when the world
does, a contact changes tens of times a second, and subscribe's dedup would
fight it. Throttled to 40ms, physical contacts only, and the release is never
dropped or she keeps staring at where the finger last was.
A toplevel is classified at its first commit rather than at map, because
xdg_toplevel is created before the client sends set_app_id — so the old code
minted a zone, moved the strip, took the keyboard and told the dock about a
window it had not yet identified. Furniture (org.souveraine.face) takes no
zone, is announced to nobody, wears no frame, keeps its own size, and hangs
from the top of the zone with the room below it left free.
windows_under never consulted wl_surface.set_input_region, so a transparent
surface took every contact inside its bounds. The face is the width of the
panel, so that was the whole screen. This also stops GTK client-side
decoration shadows from eating taps meant for what is behind them.
state reports furniture and its input rectangle count: neither is visible on
the glass, and a face that swallows the screen looks identical to one that
does not.
blueline's SW43408 has no EDID and viewtop has been scanning out raw sRGB
onto a ~P3 panel since the move off Hyprland, so everything reads
oversaturated. The linear-light transform lives in the GLES fork; this side
owns which matrix, because only the compositor knows which device it is.
Default off, and off is a separate shader path rather than an identity
matrix, so it is bit-identical to before. TASK-61.
Fork pin moves to 645961c, which is the colour-transform branch folded into
souveraine; the branch is deleted. The local [patch] used to verify it was
never for commit and is gone.
Opening a second app from home claimed zone 1 unconditionally once it
existed, so both apps shared one workspace and placement.rs split that
zone top/bottom. The home path now checks occupancy the same way the
non-home path does; an occupied neighbour mints a fresh zone instead of
dividing the first one.
Extracted the decision into a pure, testable pick_zone_for_new_window
with a regression test.
