publish: the public projection begins here

This is a projection, not a development branch. The tree above was constructed
from the internal source named below under a manifest that decides which paths
may leave, then scanned as a whole tree rather than as a series of patches, and
only then published.

Public history starts here because the history before it was not admissible,
and neither was the tree. What used to stand in this repository included a
rescue copy of another machine, a directory of phone handoffs, deployment
wired to one house, and a submodule pointing at a forge no stranger can reach.
None of that was ever the product. It stays in the private forge, which is
allowed to hold the whole working organism, and this is what was deliberately
sent out instead.

Three mechanisms produced this tree, in decreasing order of trust. A top-level
path the manifest does not name never arrives at all, which is the one that
catches directories nobody has thought of yet. Named internal files inside
admitted roots are dropped. A short, reviewed table replaces deployment
defaults that a public build must not carry -- an endpoint aimed at one LAN, a
VPN profile belonging to one phone, packaging built from one checkout path.

Everything after this commit is an ordinary publication with the same three
trailers, so a force push stops being routine and starts meaning that
something deliberate happened. The trailers bind the projection to its source
without pretending the public SHA is the private one: same lineage, different
tree, and the record says so.

Source-Sha: 8f27b1e76a8fef560a336aba18e6990713ff1047
Policy-Sha: 6b261d2f3e6e1fb19874846ba4bb1dfe15565d25b8618c1c1afba0419c101d27
Tree-Digest: 18ec3563c5e5ef9a414993a9f6734b251ff9ed3cd56eebdd6cac01e45c6e3067

packaging/souveraine-button

@@ -0,0 +1,68 @@
+#!/bin/sh
+# Report a hardware button edge to the session authority. That is all it does.
+#
+# It replaces `blueline-power-button`, which was policy in shell script: it read
+# its own copy of the panel state, asked the SHELL to lock over `qs ipc`, polled
+# `session state` twenty times at 100 ms grepping JSON for `"locked": true`, and
+# then called `blueline-screen-toggle off` itself. Three separate problems:
+#
+#   1. It blanked the panel without going through sessiond's `request_blank()`,
+#      so LOCK-DPMS-LESSONS §1 ("every path to a dark panel routes through it —
+#      an invariant, not a coincidence") had a hole in it, and the hole was the
+#      most-used control on the device.
+#   2. It carried its own copy of the lock-then-blank ordering, which is the
+#      exact duplication DEVICE-STATE-MACHINE §1 is about: seven blind actors,
+#      three of which can turn the screen off.
+#   3. It could only ever see one edge, so it could never tell a tap from a
+#      hold. Gesture recognition needs time, and a process that exits cannot
+#      hold any.
+#
+# Now the machine owns all three. This reports `down` and `up`; sessiond
+# accumulates them into tap / double / triple / hold and decides what, if
+# anything, that means.
+#
+# Wire it up in hyprland.lua as a PAIR — press and release:
+#
+#   hl.bind( "XF86PowerOff", hl.dsp.exec_cmd("souveraine-button power down"), { locked = true })
+#   hl.bindr("XF86PowerOff", hl.dsp.exec_cmd("souveraine-button power up"),   { locked = true })
+#
+# Only reporting `down` gives you a machine that thinks the button is held
+# forever: the hold threshold passes, `Hold` fires, and no `Tap` ever resolves.
+set -eu
+
+button=${1:-power}
+edge=${2:-down}
+
+case "$edge" in
+    down | up) ;;
+    *)
+        echo "usage: souveraine-button <power|volume_up|volume_down> <down|up>" >&2
+        exit 2
+        ;;
+esac
+
+runtime=${XDG_RUNTIME_DIR:-/run/user/$(id -u)}
+sock="$runtime/souveraine/sessiond.sock"
+
+line="{\"op\":\"button\",\"button\":\"$button\",\"edge\":\"$edge\"}"
+
+# Fire and forget, with a hard timeout. A button press must never block on the
+# authority being slow — the user is holding the button and the phone must not
+# feel stuck. Losing an edge degrades to a missed gesture, which is recoverable;
+# hanging here is not.
+#
+# No nc/socat on this device (checked), so this is Python's stdlib or nothing.
+exec timeout 1 python3 -c '
+import socket, sys
+sock, line = sys.argv[1], sys.argv[2]
+try:
+    s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    s.settimeout(0.8)
+    s.connect(sock)
+    s.sendall((line + "\n").encode())
+except Exception:
+    # sessiond down. Say so in the journal and drop it: a button reporter that
+    # falls back to acting on its own is the thing this file exists to delete.
+    print("sessiond unreachable; button edge dropped: " + line, file=sys.stderr)
+    sys.exit(1)
+' "$sock" "$line"