July 27, 2026

A byte count cannot tell a LoadNanoappResponse carrying success=true from one carrying success=false. elmyra loads and answers 52 bytes, and a squeeze produces nothing; without the bytes those two cases are indistinguishable.

Encodes LoadNanoappRequest by hand (verified field-for-field against a flatc-generated reader) and names the file rather than shipping it: the DSP opens it over HexagonFS, which hexagonrpcd already serves.

Methods 3-5 recovered by reading the six invoke scalars out of the vendor host daemon. Method 4 is get_message_to_host, not load_nanoapp: there is no load_nanoapp RPC, loading is a LoadNanoappRequest flatbuffer sent over deliver_message_from_host.

0016 was generated via Python heredoc which mangled escape sequences. Regenerated from hand-written files via git diff --cached. Full 0001-0016 sequence verified clean on fresh upstream clone.

0015-apps-std-implement-ftell.patch was written against upstream but patches 0007-0014 shifted the apps_std.c line numbers. Regenerated against the actual post-0014 state. Full sequence 0001-0016 verified clean.

chrecd now loads the elmyra nanoapp after starting CHRE: - Method 4 (load_nanoapp): SC=0x40100200, 1 in-scalar (size), 2 out-scalars (txn_id, result). Binary delivered through HexagonFS file bridge. - chrecd accepts optional argv[1] for nanoapp path, defaults to /usr/share/qcom/sensors/sdsp/elmyra.so. - initialize_reverse_monitor (method 2) called before start_thread.

stevia 0.56.0-9: drop the terminal layout (0005).

Every failure path in shellReady answered cb(false) — no lock owed — so a socket that was not up, a duplicate handshake, or a 3s timeout all concluded the session was open. The timeout logged 'proceeding without sessiond' and left the phone unlocked at exactly the moment the authority was unreachable, while the daemon side of the same contract retakes the lock on heartbeat EOF 'whether or not the session was locked at the time. Fail closed.'

onScreenLockSecureChanged is an edge. After a sessiond restart our lock surface is already secure, so the edge is in the past and the ack owed by the new handoff was never sent — sessiond logged 'shell never confirmed its lock after handoff' and retook the lock 15s later.

SessionEvents asked loginctl for -p ObjectPath, which is not a property — it returned empty on every boot, so external lock signals were never monitored and the shell had no unlock ingress. Resolve the graphical session the way lockhint.rs does; not GetSession(auto) (this shell is a session-less user unit) and not the /session/auto alias (PropertiesChanged only fires on the concrete path).

Accel inferred moving from orientation edges, so Moving(false) was only reachable from the startup banner — boot 0 carried 165 true to 8 false and the keepalive re-sent a stuck true every 30s, pinning +0.3 into observed_confidence for the life of the process. Motion now decays over MOTION_WINDOW and the keepalive re-derives it.

sensord hung off graphical-session.target, which nothing on this device starts, so it was enabled and dead from every boot. Down starts from a last-seen stamp and structurally cannot see that. Bind the reporter to sessiond and make the machine say so.

An empty home/casey still ships and still trips the stray check. Runs 1234 and 1248 were both this guard, not the build.

Run 1234 failed because the new stray check omitted var/lib/upower.

udev rules and hwdb installed under the sysroot prefix, so none of the fork's quirks were ever active on the phone.

PM8998 GPIO 2 gates the MAX11261 strain-gauge supply and nothing raised it from the kernel. Replaces a systemd unit holding the line with gpioset.