blueline-fingerprintd installs /usr/lib/security/pam_souveraine_fpc.so
(PKGBUILD:48). cc541d1 named pam_fpc_polkit.so, which exists nowhere.
The leading '-' means a missing module is skipped without complaint, so
a wrong name here fails silently and permanently: the finger does
nothing and no log says why.
The module returns PAM_IGNORE outside PAM_SERVICE=polkit-1
(fpc-polkit-pam.c:86), so step-up falls through to the password stack
until that allowlist widens.
SESSION-AUTHORITY-DOCTRINE §3 names /etc/pam.d/souveraine-stepup by path.
Root-owned config can only arrive by package: rootfs-overlay/ reaches a
device on flash and the phone does not flash.
auth_self, never auth_admin — step-up re-proves the user to themselves, it
does not escalate. The leading '-' on pam_fpc_polkit.so loads the fingerprint
factor only where it is installed, so one file serves phone and laptop.
Inert until a consumer calls it; no src/ path does yet.
