souveraine/packaging/souveraine-sensord.service

[Unit]
Description=Souveraine sensor reporter (proximity, light, charge)
# One reporter for every iio-sensor-proxy source. Replaces the per-sensor shell
# scripts (blueline-proximity-lock and the light/accel copies that were about to
# be written) — see DEVICE-STATE-MACHINE.md §10 and §12.
#
# A user unit, like sessiond: it talks to sessiond over
# $XDG_RUNTIME_DIR/souveraine/sessiond.sock and needs no privilege at all.
#
# Bound to sessiond, NOT to graphical-session.target. It was WantedBy that
# target until 2026-07-27, and on this device nothing ever starts it: greetd
# launches Hyprland directly, and hyprland.lua starts each unit it wants by
# name. So the reporter was `enabled` and dead from every boot, the machine ran
# with no evidence at all, and — because a source that has never spoken sits at
# SourceHealth::Unknown, which is silent by design — nothing said so.
#
# The dependency that is actually true is this one: the reporter exists to feed
# the state machine, so it should live and die with the state machine. sessiond
# is started explicitly at session start, needs no Wayland, and neither does
# this: it reads iio-sensor-proxy on the system bus and writes a unix socket.
PartOf=souveraine-sessiond.service
After=souveraine-sessiond.service

[Service]
ExecStart=/usr/bin/souveraine-sensord
# The reporter must outlive every transient failure it can hit — a dead sensor
# stack, a restarting sessiond, monitor-sensor exiting. It handles those in
# process; this covers the ones it cannot.
Restart=always
RestartSec=5

[Install]
WantedBy=souveraine-sessiond.service
sensord: one reporter for every sensor, replacing the per-sensor scripts blueline-proximity-lock is 113 lines of shell implementing a subtle contract (heartbeat inside SOURCE_DOWN_AFTER, seed from the probe banner, report both edges) that would have been hand-copied for light and again for accel. One binary, one contract, shipped in the package instead of the rootfs overlay. 2026-07-26 18:46:27 -04:00			`[Unit]`
charge becomes a sensor source ChargeEvidence was the rule violated four times in one type: a side door past the gate, the decider probing sysfs on the clock, the driver interpreting, and nothing leaving tick(). Its comment cited bearer — another instance of itself. SensorSource::Charge now enters through sensor_input like every other source, reported by sensord on a 30s poll off /sys/class/power_supply. conclude_charge lives on the machine as its one decision; source health, freshness and Absent/Down come from the gate for free. The 5s clock probe is gone, the driver type is gone, and sensord ships x86_64 too: the laptop has a battery. 2026-08-15 11:45:22 -04:00			`Description=Souveraine sensor reporter (proximity, light, charge)`
sensord: one reporter for every sensor, replacing the per-sensor scripts blueline-proximity-lock is 113 lines of shell implementing a subtle contract (heartbeat inside SOURCE_DOWN_AFTER, seed from the probe banner, report both edges) that would have been hand-copied for light and again for accel. One binary, one contract, shipped in the package instead of the rootfs overlay. 2026-07-26 18:46:27 -04:00			`# One reporter for every iio-sensor-proxy source. Replaces the per-sensor shell`
			`# scripts (blueline-proximity-lock and the light/accel copies that were about to`
			`# be written) — see DEVICE-STATE-MACHINE.md §10 and §12.`
			`#`
			`# A user unit, like sessiond: it talks to sessiond over`
			`# $XDG_RUNTIME_DIR/souveraine/sessiond.sock and needs no privilege at all.`
sessiond: an expected source that never reports is Absent, not silent sensord hung off graphical-session.target, which nothing on this device starts, so it was enabled and dead from every boot. Down starts from a last-seen stamp and structurally cannot see that. Bind the reporter to sessiond and make the machine say so. 2026-07-27 15:34:09 -04:00			`#`
			`# Bound to sessiond, NOT to graphical-session.target. It was WantedBy that`
			`# target until 2026-07-27, and on this device nothing ever starts it: greetd`
			`# launches Hyprland directly, and hyprland.lua starts each unit it wants by`
			# name. So the reporter was `enabled` and dead from every boot, the machine ran
			`# with no evidence at all, and — because a source that has never spoken sits at`
			`# SourceHealth::Unknown, which is silent by design — nothing said so.`
			`#`
			`# The dependency that is actually true is this one: the reporter exists to feed`
			`# the state machine, so it should live and die with the state machine. sessiond`
			`# is started explicitly at session start, needs no Wayland, and neither does`
			`# this: it reads iio-sensor-proxy on the system bus and writes a unix socket.`
			`PartOf=souveraine-sessiond.service`
sensord: one reporter for every sensor, replacing the per-sensor scripts blueline-proximity-lock is 113 lines of shell implementing a subtle contract (heartbeat inside SOURCE_DOWN_AFTER, seed from the probe banner, report both edges) that would have been hand-copied for light and again for accel. One binary, one contract, shipped in the package instead of the rootfs overlay. 2026-07-26 18:46:27 -04:00			`After=souveraine-sessiond.service`

			`[Service]`
			`ExecStart=/usr/bin/souveraine-sensord`
			`# The reporter must outlive every transient failure it can hit — a dead sensor`
			`# stack, a restarting sessiond, monitor-sensor exiting. It handles those in`
			`# process; this covers the ones it cannot.`
			`Restart=always`
			`RestartSec=5`

			`[Install]`
sessiond: an expected source that never reports is Absent, not silent sensord hung off graphical-session.target, which nothing on this device starts, so it was enabled and dead from every boot. Down starts from a last-seen stamp and structurally cannot see that. Bind the reporter to sessiond and make the machine say so. 2026-07-27 15:34:09 -04:00			`WantedBy=souveraine-sessiond.service`