July 24, 2026

Two install blockers found on the phone: - the package shipped org.freedesktop.secrets.service, which gnome-keyring owns. souveraine-secrets holds the bus name at runtime already. - upower reused souveraine's 0.1.rN version, which sorts below the hand-built 1.91.3+sha, so -Syu saw a downgrade and skipped it. Now built from upstream version + fork sha (verified vercmp = 1).

All four repo binaries were hand-copied to the phone and owned by no package. secrets/machined ship on both arches; sessiond stays aarch64. secrets unit repointed /usr/local/bin -> /usr/bin.

It was hand-copied to /usr/local/bin, owned by no package, so it never updated. Not built for x86_64 — the laptop hits lock-screen errors with it. Verified both packages assemble correctly.

Seventh instance of the same wrong path: the package-content assertion looked for usr/lib/upowerd. upower installs to usr/libexec/upowerd — the copy already on the phone confirms it — so the check failed after a successful build and sign.

The upower steps were added after the last green release and had never run successfully — the Jul 13 edge release contains no upower package at all. Six defects, each hiding the next, found by reproducing the steps on the runner:

The previous run raced a concurrent cargo build on the [host] runner for the shared ~/.cargo package-cache lock and failed in 92s.

init() scaffolds only system/; the other schema roots are created on first write by the real write path. Three tests seeded fixtures directly into issues/, projects/ and reference/ and died on ENOENT, which failed cargo test and skipped the packaging job that publishes the pacman repo.

The submodule was pinned one commit behind the fix, so every CI-built upower-souveraine fell through to the warning path and reported charge-type unknown while discharging.

sessiond: - device_state.rs: 8-state unified device state machine with legal transition table, sensor evidence model (proximity/accel/light/touch), confidence scoring, cross-sensor disagreement detection, and forensic logging with full state snapshots at every decision point. - protocol.rs: extended with DeviceState, SensorInput, and ForensicLog IPC requests. SensorSource/SensorValue types for proximity, accel, light, touch. - server.rs: DeviceStateMachine integrated into Daemon struct. Handlers for DeviceState (full state query), SensorInput (sensor evidence + Observed transitions), Forens...

25 captures the pipeline unification: souveraine's CI is the only one doing repo-add --sign, so everything else has to be hand-carried to the phone. Records the phone-side wiring that went live today and the two pacman traps behind it (DownloadUser vs a custom XferCommand, and the DisableSandbox* lines that were never real options).

Records what the 2026-07-21/22 sessions actually found and shipped, so the ledger matches reality:

Kernel included. boot_a is stale (still has pmos_root_uuid, no root=) and is not in the boot path — pocketboot reads extlinux off Arch_root.

build() called arch-meson, which injects host -march/-mtune and hands x86_64 flags to an aarch64 compiler; prepare() fetched crates for the host tuple. Both now go through build-cross.sh so the cross knowledge lives in one place. build-cross.sh honours WORKDIR/BUILD so makepkg can run it inside $srcdir instead of the PKGBUILD directory.

PKGBUILD lists it in source=(), so a clean clone could not build without it.

The PKGBUILD said to build natively on the device, which contradicts pkgs/README.md and is not viable on 3.5G of RAM. Both halves cross fine.

The pmi8998 charge-control fix renamed the sysfs attribute from charge_control_limit to charge_control_end_threshold. The CLI, its udev rule, and platform.md still referenced the old name, so the existence check failed outright on the fixed kernel.

Attachments now move both ways. Received images, video, audio, and files download from mxc:// URIs to a content-addressed cache and render in place. Staged local files upload on send, with MIME guessed from the extension.

An empty or malformed date field defaulted to the current time, so old unread messages sorted as just-arrived. Default to epoch 0 instead.

Second-review follow-ups.

Adversarial review of f08dc70b3 found four real defects. Fix them.

The kernel prints POWER_SUPPLY_CHARGE_TYPE_NONE as "N/A", not "None", so up_device_charge_type_from_string() fell through to the warning path and returned UNKNOWN instead of NONE on every refresh while discharging.