July 31, 2026

Reports down/up edges to sessiond and decides nothing. Wire it in hyprland.lua as a bind/bindr pair — reporting only the press leaves the machine believing the button is held forever.

blueline-power-button decided policy in shell script — read its own panel state, asked the shell to lock over qs ipc, polled, then blanked the panel itself. That was a path to a dark panel outside request_blank(), so §1's lock-then-blank invariant had a hole in the most-used control on the device.

PanelLoader is a LazyLoader gated on Config.ready, behind a second one. On reload both are shut when quickshell propagates, so LazyLoader has no item to hand its successor and the new WlSessionLock never adopts the live compositor lock. Lock is a direct child of ShellRoot now, as the boot-order doc already asked.

A held connection receives one trail entry per notable edge: transitions, source-down/recovered, violated guarantees. Readings, wakes and heartbeats never cross — the filter is the point, not the transport.

UnixStream::peer_cred is still unstable, so it only failed at the aarch64 build after rust-test had gone green. Use the same getsockopt machined uses.

sessiond admits shell_ready from the lease holder's own pid; the shell carries its lock request through the reload so WlSessionLock adopts the existing lock instead of taking the unlock branch on it.

It read "On" for an hour through a dead tunnel — NM said activated while wg had 368 B received against 5.3 KiB sent. Now off/connecting/limited/online, decided by a 2s probe of the far-side resolver rather than by the interface being up. Sailfish models the same distinction (Online/Limited/Connecting); Android won't let an unvalidated network win at all.

GroupButton called it unguarded while releaseAction two lines up was guarded. altAction is null for every toggle without a menu, so a long-press threw. Only showed once the toggles that had been filtered out of the panel started rendering.

TASK-08(f)/TASK-19: state, panel, evidence, confidence, per-source health, the sensors_degraded flag and the recent decision trail were legible only through forensic.jsonl. DeviceEvidence gains a read path (polled only while watched); the Device page renders it. Readout only — the confidence gates are still computed and never branched on, so controls over them would lie.

It is not a git repo, it gets edited on the device, and this path had no snapshot while the local compose path has had one all along. Now it snapshots to ~/souveraine-surfaces/.quickshell-previous, copies by checksum, and only reports phone-only files instead of destroying them.

Tier 2 was written, deployed and mounted by nothing — its own header named the gap. The chat sidebar hosts it now: ticker long-press, or the psychology indicator by the input box, which works when no pass is running.

The hand-written allowlist in AndroidQuickPanel had drifted from it, so the phone rendered 12 of its 17 configured toggles and said nothing about the rest. Adds the missing fullScreenshot and waydroidTerminate, and a deploy guard so the phone chooser can't fall behind the base one again.

selectAgent cleared conversationId even when the agent hadn't changed, and the 60s inventory poll re-selects the persisted agent forever — so any message sent a minute after the last one opened a fresh conversation. 27 of them yesterday, four messages each. An empty curl body no longer counts as "no conversations".

The old [host] profile shared its address and private key with the laptop, so WireGuard could only hold one of them, and the key is no longer listed server-side — it sent and never received. [host] is [host], port 51822, keepalive 25. Proven off-LAN: handshake 8s, gitea 200 in 0.126s.

Measured on the phone: all IPv4 left over cellular while on wifi, because NM penalised the wifi metric +20000 for a failed connectivity check, which failed because the VPN profile injected a resolver reachable only over the degraded default. Prior art read off the local LineageOS image and Sailfish tree: both route DNS per link and gate preference on a probe. We do neither.

Device page renders state, evidence, per-source health, sensors_degraded and the decision trail. Notes what is still absent from device_state: last-seen per source, and grip as a fourth source.

Tier 2 reached the tree on 07-30 and the glass on 07-31 — nothing mounted it in between, and that was invisible because a component nobody instantiates logs nothing. Notes why verifying a row means looking at the glass.

Re-measured by md5 across both devices. The ii-base pin + ii-phone overlay landed without this task being worked and killed the drift: laptop-only is 0, the settings suite is byte-identical everywhere, and the 4 phone-only files are the declared overlay.

51822 not 51820; the phone has its own peer ([host]) rather than sharing the laptop's key; keepalive 25 not 0. Records that the autonomous gate is dead and why a full tunnel that cannot handshake takes the machine with it.

on_vblank was a trace! and nothing drew. Every panel now owns a DrmCompositor (GBM swapchain, damage, plane assignment); the flip is answered, the frame is built and queued, and clients get their callbacks so they draw a second frame.

The kms binary compiled for no target at all — the workspace cross-build skipped it (required-features = nested) and the nested step is host-only. Both backends are cfg-gated with a bail fallback now, so the binary builds with kms alone and the Pixel 3 target is actually checked.