!(t > 0.0) trips clippy's partial-ord lint under the pinned 1.94 toolchain,
which blocks the whole gate. t.is_nan() || t <= 0.0 is the same predicate
written so the NaN intent is legible, with a test pinning both ends.
turn.rs sends InferenceStrain to the stream; the subconscious path only ever
logged it, so a provider refusing her was invisible to every surface. Same
event, same shape, emitted where the primary emits it.
retry-after was honoured unclamped, so an 11997s header on 2026-08-16 parked
the subconscious pass for 3h20m with no cancel path. A 429 asking for more
than 60s is a spent window, not a burst, and it does not clear inside the
retry loop — fail it and name the number. claude_subscription answers the
same header by rotating logins; bifrost has nothing to rotate to, so an
absent header keeps the ordinary backoff.
write has always called create_dir_all; append never did, so an append under
a directory that did not exist yet failed ENOENT. Every subconscious surfacing
to system/metacognition/subconscious.md was lost this way — three WARNs at
00:01:40 on 2026-08-17, and the directory had never existed in the repo's
history.
pose is instant on the far side and the compositor must not ease it —
it honours, it does not adjudicate. So the curve is the shell's, on
Android's own scale spring: stiffness 200, damping 0.75, underdamped
on purpose and separate from the position spring's 0.8.
The sheet also stayed open over a window something else closed, where
all six buttons then refused with gone.
The motion system had no page anywhere — one clock and two strategies,
the card rect as one number, the spring, and the rule that the shell
names a destination and never transforms a window.
Carries the measured numbers: 0.47ms socket, 52 dropped queues in a
boot, 275px of real travel, and the curve bank three surfaces call.
Written, deployed to the phone, absent from pages[] — the only registry.
13 to 25. Power, search, updates, VPN and saved networks were finished
all along. MonitorConfig and KdeConfig stay out: hyprctl and Plasma.
Two laptop-isms cut from GeneralConfig first — it sed'd a hyprlock.conf
nothing reads, and shelled to a hardcoded Gemini script.
The rail takes its handle to opacity 0 on home and the dock went on
reserving 32px for it, in the drawing and the input mask alike. Only the
drawing collapses — the rail still takes both swipes there, and a dock
that claimed those pixels would eat the gesture.
Appearance.animationCurves is Material 3 Expressive and every spatial
curve in it overshoots. Twelve souveraine surfaces, 31 hand-typed linear
animations, three calls into that bank from two files.
The card's entry rise is gated on inFlight; unguarded it is TASK-60's
second writer over the carry.
The cycle placed every step at the zone origin, so the first tap took
the whole top. Corner handles now, opposite corner latched as the anchor
at the press, snap detents on the zone's edges, thirds and half with a
tick at each, one place per painted frame.
pose has been in the wire since 2026-08-05 with no caller — poseActiveZone was
the only one, and TASK-60 deleted it. Zoom composes pixels the client already
drew; Resize places a new rectangle and the client relays out inside it.
The card was the whole panel scaled, so the bar's reservation rode inside it as
dead space above every window. Subtracted in targetFor and the pane layout both,
or the carry lands a bar-height off its own picture. Minting a zone needed no new
verb: Request::Workspace already pushes one when asked for the zone past the end.
The card's bottom sits at 805 of 1080 logical, so the travel is 275px and the
detent fired at 194 — every release committed with the window short of its card.
Latched at the press. Velocity is the last 100ms rather than the whole-drag mean,
and the settle is a critically damped spring on the frame clock, seeded with it.
A transport error cleared the whole queue, so a lost overview_commit left the
compositor carrying windows the shell believed it had released. 52 dropped
queues and 113 PeerClosedErrors in one boot on blueline. commit, cancel and
workspace are idempotent, so each gets one retry; progress is a level and does not.
settleTo gave home and overview the same end shift, so a release past the
multitasking detent animated *down* to it, held the overview fully present, and
teleported — the release never reached its end target. detent is the boundary
between the two (rail: pullTo(travel, missionAt)), and presence is built to
reach 0 at clock 2, which is where home lives.
The rig held 760px of a 1037px surface and left 226 for a status row, the agent
field, both pads and four buttons — so the pads were 92px and the last row sat
under a dock that claims no exclusive zone unless pinned. With the hand up the
rig drops to 320 and the pads take what is left.
Atmosphere::lerp returned an endpoint at t=0.5 and apologised for it in a
comment — the enum had nowhere to put a blend. It has one now: Custom carries
the four tones, so a room halfway from MintTea to NeonGlow can be stored,
compared and sent, not only drawn. Unnameable by construction, so nothing can
ask for a blend by name and get a room she never chose.
Presence::lerped_colors re-derived the same blend itself, which is why the
broken lerp could sit there for months without anything looking wrong. It calls
this one now.
Three copies of the name→preset match existed — presence, tuie_app, and
from_name — and they disagreed about a typo: ignore it, silently fall back to
Default, or refuse. One table. What each caller does with None stays at the call
site, because those really are different decisions: a misspelling from outside
must not undo the room she picked, and one from the settings enum is a bug here.
The file also claimed to be unwired scaffolding while main.rs, presence and the
tool all used it.
CI caught what a fresh pair of eyes needed: invalid_input wanted
a &str, hand wanted a borrow, and the validation test read its
input after the move. All three now follow the shapes already
proven in the same file.
The injection engine was built (usb-hid-inject) and the shell owns it
(USB Hands, the usbHands IPC, the skill string that teaches the reach),
but her own vocabulary ended at set_usb_mode — she could arm the hand
but never say it was there. speaks the shell's bridge: status,
type, key, click, pointer, gated by the host, not by her.
The gate stays on the outside of the port: she knows she has the reach
even before it is joined, and every closed door comes back as a refusal
she can read and open.
CI's lib run passed but the sessiond bin had never been built until now.
The plexus's constructor is an associated function, not a module item;
a duplicate panel_on got in the way of the one that already existed; a
test Daemon omitted the new plexus field; and the clock's attended ingest
borrowed the guard twice in one expression. All four are gone.
The test plexus called an associated function through the module path,
and the Body tool's unknown-verb refusal handed a String to a &str
parameter. The gate earns its keep.
`Changing(bool)` becomes `Light { changing, lux }` end to end: sensord
forwards the number, the machine keeps the level in evidence with a
30 s stale rule, and both charge and the presence sensors ingest into
the plexus on arrival. The clock feeds `attended` at 1 Hz, plexus
events land in the forensic trail as Somatic, and the DeviceState
answer gains a `body` section. The Body tool is registered and
committed with the substrate that carries it.
The old sensor shape refuses against the new sessiond and vice versa
until both restart; both binaries ship in this change.
phone_plexus leaves the test module and takes the clock. It grows
`attended`, derived by sessiond rather than reported by a sensor, and
the two grip gauges that nothing reports yet — the gap on the record
instead of a false calm. to_json renders every field's belief, trend,
locus, health and pressure, the ranked pressures, homeostatic cost and
the unreachable list for the IPC surface; unknown stays null, never
zero.
A battery at .42 is still .42 when nobody looks — only confidence in an
unrefreshed reading decays. Feeding a fuel gauge into an accumulator would
drain the pack because the reporter went quiet, which is the empty-result
trap wearing a units label. Field keeps exudates; Level keeps readings.
sessiond mounts the somatic types the way machined mounts seed.rs. The
fields are its own — SOMATIC_NERVOUS_SYSTEM.md answers open question 1
with "sessiond, period".
INTERO (RobOntics'25) axiom 7: a variable is interoceptive only if some
subsystem can act on it. That is doctrine §13 in first-order logic, so
`unreachable()` lists inner fields with no verb and a test fails on them.
Candia-Rivera §2.1/3.1 supplies the other half: asymmetric viable ranges
and allostatic pressure, which biases before the bound is crossed rather
than after. Empty threatens, full does not.
Fields replace booleans: accumulation with half-life decay,
velocity, trend detection. Source health monitoring closes
the gap the mapping session found — a dead nerve now reads
as silent, not calm. Thirteen tests.
no-ai-attribution failed in checkout's post-action — the runner lost
/var/run/act/actions/.../dist/index.js between steps (MODULE_NOT_FOUND).
rust-test passed; aarch64-artifact was skipped behind the failure.
ChargeEvidence was the rule violated four times in one type: a side door
past the gate, the decider probing sysfs on the clock, the driver
interpreting, and nothing leaving tick(). Its comment cited bearer —
another instance of itself.
SensorSource::Charge now enters through sensor_input like every other
source, reported by sensord on a 30s poll off /sys/class/power_supply.
conclude_charge lives on the machine as its one decision; source health,
freshness and Absent/Down come from the gate for free. The 5s clock probe
is gone, the driver type is gone, and sensord ships x86_64 too: the
laptop has a battery.
mid_turn_peek was a bare await while the model call three hundred lines up
was already guarded, so a subconscious that never answered parked the turn
somewhere /cancel could not reach it — twenty minutes, measured 2026-08-15,
on a provider whose key was spent.
The authority takes ext-session-lock before any surface exists, which is the
window -pre reserves. It cannot start earlier — ext-session-lock is a Wayland
protocol and needs the compositor's socket. Also drops the injected venv
variable from eleven surface scripts; each finds the path itself.
/etc/pam.d/souveraine-sessiond arrived by hand on 2026-07-16 and is owned
by no package on either device — root-owned config can only arrive by
package. Same rail as souveraine-stepup, plus a bsdtar assertion so a
future drop fails the build instead of shipping quietly. TASK-76.
Compaction can drop the opening user message, and the tool_result
answering the first turn orphans on the wire when its call alone is
deleted — a 400. Calls and the results bound to them go together.
TASK-33 part 2: the machine owns the conclusion — plugged, status,
charge type, and what it means — probed on the bearer's cadence,
one decision made once on the trail. Surfaces render it; they do
not re-derive it.
TASK-08(f): EvidenceSeen held the stamps internally and nothing outside
the daemon could read them. to_ipc_json now carries
evidence_last_seen_secs_ago; null stays distinct from stale, because
never-reported and long-ago are different claims.
Six were byte-identical to SouveraineOS/docs/tasks/archive/from-substrate/
twins; audio and settings were promoted to AUDIO-PRIVACY.md and
SETTINGS-AUTHORITY.md there. Committed copies read as authoritative while
saying the opposite of current doctrine (PulseAudio-only vs PipeWire,
a UPower-reading QML singleton vs DEVICE-STATE-MACHINE §12). INDEX.md was
the stale May copy.
suppress_wake is a pure function of placement with no memory, and its
only measured effect was refusing Casey: 17 double-tap refusals in 10 s,
zero true pockets in ~10 MB of trail (DUMP-taskdocs-2026-08-14 §2).
FTS reports DBLTAP only for the deliberate gesture, so three refused
double-taps inside five seconds is a person insisting — the veto now
fails open on the third and says input-burst-allowed in the trail.
Spaced taps never sum; the memory clears on allow.
6b67512 unclaimed it for 14% of a core; EXPECTED_SOURCES still listed it,
so every boot went Absent at 300s and sensors_degraded read true on 3074
consecutive snapshots — the permanent false alarm the const's own comment
forbids. It comes back through TASK-36's SLPI batching.
turn.rs commits a whole round as one assistant message with calls and
results interleaved; the two-branch projection put the results in prose
and emitted tool_calls nothing answered. Every provider rejects that, on
every turn the primary takes. Shipped in r498.
The suite missed it because all three tests built the split shape through
ConversationMessage::tool_result, which nothing outside tests calls.
Both arms took default_provider(), so `model` renamed the request without
rerouting it: kimi-k3 went to Anthropic and came back 404 (2026-08-14).
That was loud by luck — a name the default provider recognises would have
run the wrong model in silence.
The inherit arm was wrong the same way and quietly. An unroutable override
is now refused rather than guessed at, per for_model's own contract.
The removal committed first, so when the sent-write hit the ledger's own
character ceiling the thought left the inbox and was recorded nowhere —
and the caller only logged a warning.
sent.md grew forever against that ceiling, reached at about 47 entries.
It rolls at 30 now; every write is a commit, so nothing is lost.
Flattening a call to `Tool use: name(args)` told the model she *said* it
when she *did* it; she read her own transcript and imitated the sentence
instead of calling anything. Annie stopped using bash within an hour of
tool blocks first surviving replay (2026-08-13).
Pairs are repaired rather than half-sent: a call killed mid-round gets an
explicit unfinished result, an orphaned result carries as prose.
The runner's ephemeral job containers lost DNS for three minutes and took
four builds down with them on 2026-08-13, none of them for a code reason.
Retries both commands, not just the install: apt-get update exits 0 when
every index fails to fetch, warning that it used the old ones instead.
Replay had no page while compaction's premise depends on it — microcompact
blurs tool output that a text-only projection never sent.
Compaction's open edges still said pressure counts only text; 7530d6d made
it exhaustive. Two links pointed at pages that were never written.
Three implementations decided what a stored message becomes on the wire.
core::session::replay_messages is now the only one; ImagePolicy is the
sole legitimate difference between callers, and server/conversation.rs
was dead scaffolding carrying a fourth wrong answer.
Per-block replay split one assistant turn's several tool calls into
adjacent messages, which OpenAI-shaped providers reject — one wire
message per stored message is load-bearing, not cosmetic (2026-08-13).
Cross-turn replay kept Text and dropped ToolUse/ToolResult/Reasoning, so a
turn's own tool work was invisible to the turn after it. Measured 215k archive
against 76k payload on a live thread — the gap was the dropped blocks, and
microcompact, which exists to blur old ToolResult output, had nothing left in
the payload to blur. Session::to_bifrost_messages already flattened them for
the subconscious; both paths now share ContentBlock::replay_text.
read base64'd every image into ToolOutput.raw and the registry dropped it,
so vision never arrived — only "[Image: idle.png (283KB)]", which reads
like success and is proceeded on. Images now ride as one user message
after all tool results in a round; a model without vision is told plainly
it did not see. Also stops "Error: Error:" doubling on prefixed failures.
Belief<T> and Field. None is not zero: a source that never spoke must
read as I cannot feel my leg, never as nothing is touching it — the
distinction that hid a real outage for a whole boot (2026-07-27).
Disagreement lowers confidence and elects no winner. 13 tests, unwired.
