package sessiond (aarch64 only)

It was hand-copied to /usr/local/bin, owned by no package, so it never
updated. Not built for x86_64 — the laptop hits lock-screen errors with
it. Verified both packages assemble correctly.

.gitea/workflows/ci.yml

@@ -111,12 +111,26 @@ jobs:
           file "$BIN" | grep -q aarch64 || { echo "built binary is not aarch64" >&2; exit 1; }
           cp "$BIN" souveraine-aarch64
 
+          # sessiond is a separate bin behind the sessiond feature. It was
+          # hand-copied to the phone's /usr/local/bin and owned by no package,
+          # so it never received updates; build and ship it with the rest.
+          ./scripts/build-cross.sh --features sessiond --bin souveraine-sessiond
+          SBIN="$CARGO_TARGET_DIR/aarch64-unknown-linux-gnu/release/souveraine-sessiond"
+          file "$SBIN" | grep -q aarch64 || { echo "sessiond is not aarch64" >&2; exit 1; }
+          cp "$SBIN" souveraine-sessiond-aarch64
+
           export CARGO_TARGET_DIR="$HOME/.cache/souveraine-ci-target-x86_64"
           cargo build --release
           BIN="$CARGO_TARGET_DIR/release/souveraine"
           file "$BIN" | grep -q 'x86-64' || { echo "built binary is not x86_64" >&2; exit 1; }
           cp "$BIN" souveraine-x86_64
-          sha256sum souveraine-aarch64 souveraine-x86_64 > souveraine-binaries.sha256
+
+          # sessiond is deliberately NOT built for x86_64: the laptop hit
+          # lock-screen errors with it, and it is the phone's session authority.
+          # Ship it on aarch64 only until the laptop side is sorted.
+
+          sha256sum souveraine-aarch64 souveraine-x86_64 \
+            souveraine-sessiond-aarch64 > souveraine-binaries.sha256
 
       - name: Build UPower fork (per-arch install trees)
         run: |
@@ -224,6 +238,11 @@ jobs:
             mkdir -p "$PKG_WORK" "$ARCH_REPO"
             cp "souveraine-$ARCH" "$PKG_WORK/souveraine-binary"
             cp packaging/souveraine.service LICENSE "$PKG_WORK/"
+            # aarch64 only — see the sessiond note in the build step.
+            if [ "$ARCH" = aarch64 ]; then
+              cp "souveraine-sessiond-$ARCH" "$PKG_WORK/souveraine-sessiond-binary"
+              cp packaging/souveraine-sessiond.service "$PKG_WORK/"
+            fi
             cp packaging/arch/PKGBUILD.prebuilt "$PKG_WORK/PKGBUILD"
             (
               cd "$PKG_WORK"
@@ -234,6 +253,9 @@ jobs:
             PKG=$(find "$PKG_WORK" -maxdepth 1 -name 'souveraine-*.pkg.tar.zst' -print -quit)
             test -n "$PKG"
             bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine'
+            if [ "$ARCH" = aarch64 ]; then
+              bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine-sessiond'
+            fi
             cp "$PKG" "$ARCH_REPO/"
             gpg --batch --yes --local-user "$ARCHIVE_KEY" \
               --detach-sign "$ARCH_REPO/$(basename "$PKG")"

packaging/arch/PKGBUILD.prebuilt

@@ -14,10 +14,28 @@ depends=('gcc-libs' 'alsa-lib')
 options=('!strip')
 source=('souveraine-binary' 'souveraine.service' 'LICENSE')
 sha256sums=('SKIP' 'SKIP' 'SKIP')
+# sessiond ships on aarch64 only (the phone is its target; the laptop hit
+# lock-screen errors with it). CI drops the two files into the build dir for
+# that arch and omits them otherwise, so package() picks them up conditionally
+# rather than declaring them as sources for every arch.
+if [ "$CARCH" = aarch64 ]; then
+    source+=('souveraine-sessiond-binary' 'souveraine-sessiond.service')
+    sha256sums+=('SKIP' 'SKIP')
+fi
 
 package() {
     install -Dm755 "$srcdir/souveraine-binary" "$pkgdir/usr/bin/souveraine"
     sed 's|%h/.local/bin/souveraine|/usr/bin/souveraine|' "$srcdir/souveraine.service" \
         | install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/souveraine.service"
+    # Session authority daemon, aarch64 only. Was hand-copied to
+    # /usr/local/bin and owned by no package, so it never received updates.
+    # The unit points at /usr/bin: the stale /usr/local/bin copy must be
+    # removed after installing or the old binary keeps running.
+    if [ -f "$srcdir/souveraine-sessiond-binary" ]; then
+        install -Dm755 "$srcdir/souveraine-sessiond-binary" \
+            "$pkgdir/usr/bin/souveraine-sessiond"
+        install -Dm644 "$srcdir/souveraine-sessiond.service" \
+            "$pkgdir/usr/lib/systemd/user/souveraine-sessiond.service"
+    fi
     install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 }

packaging/souveraine-sessiond.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Souveraine session authority (lock-before-shell, lock-past-shell-death)
+# Started explicitly from the hyprland.start hook after WAYLAND_DISPLAY is
+# imported into the user manager — same lifecycle pattern as hypridle.
+PartOf=graphical-session.target
+
+[Service]
+ExecStart=/usr/bin/souveraine-sessiond
+Restart=on-failure
+RestartSec=1
+
+[Install]
+WantedBy=graphical-session.target